CVE-2026-42035: Axios Header Injection via Prototype Pollution
Summary
CVE-2026-42035: Axios: Header Injection via Prototype Pollution. Affects axios across 2 version ranges.
< 0.31.1
>= 1.0.0, < 1.15.1
Fixed in 0.31.1 or 1.15.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It provides a simple API for handling requests and responses, supports promises, and allows for easy configuration of request headers and interceptors. However, a vulnerability has been identified in Axios that allows for header injection through prototype pollution, which can lead to serious security issues.
Vulnerability Detail
The vulnerability arises from a prototype pollution gadget in the Axios HTTP adapter located in lib/adapters/http.js. It allows an attacker to inject arbitrary HTTP headers into outgoing requests by exploiting duck-type checking of the data payload. If Object.prototype is polluted with specific functions, Axios misidentifies any plain object payload as a FormData instance, calling the attacker-controlled getHeaders() function and merging the returned headers into the outgoing request. This can lead to authentication bypass, session fixation, privilege escalation, and IP spoofing.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.31.10.31.1npm install axios@0.31.1 -
>= 1.0.0, < 1.15.11.15.1npm install axios@1.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can add an explicit own-property check in lib/adapters/http.js to prevent the exploitation of this vulnerability. Modify the code as follows:
} else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&
Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {
headers.set(data.getHeaders());
}```
Conclusion
The Axios vulnerability CVE-2026-42035 poses a significant risk due to its ability to allow header injection through prototype pollution. It is crucial for developers using Axios to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for axios →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, which can lead to unexpected behavior in applications.
This vulnerability can allow attackers to inject malicious headers into HTTP requests, potentially leading to unauthorized access, session hijacking, or other security breaches.
Versions of Axios prior to 1.15.1 for 1.x and prior to 0.31.1 for 0.x are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Without requiring access to the code or installation, Vulert uses package-lock.json to check for vulnerabilities.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
