CVE-2026-42040: Axios Null Byte Injection Vulnerability in AxiosURLSearchParams
Summary
CVE-2026-42040: Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams. Affects axios across 2 version ranges.
< 0.31.1
>= 1.0.0, < 1.15.1
Fixed in 0.31.1 or 1.15.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Axios is a popular JavaScript library used for making HTTP requests from node.js or XMLHttpRequests from the browser. It provides a simple API for handling requests and responses, including support for promises and interceptors. The library is widely used in web applications for its ease of use and flexibility. However, a vulnerability has been identified in the AxiosURLSearchParams component, which can lead to null byte injection due to improper encoding.
Vulnerability Detail
The vulnerability arises from a defect in the encode() function located in lib/helpers/AxiosURLSearchParams.js. Specifically, a character mapping (charMap) at line 21 reverses the safe percent-encoding of null bytes. While encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. This inconsistency poses a risk, as it can lead to issues such as URL truncation and potential bypass of security mechanisms in C-based backends. The vulnerability is classified as having a CVSS score of 3.7, indicating a low severity level.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.31.10.31.1npm install axios@0.31.1 -
>= 1.0.0, < 1.15.11.15.1npm install axios@1.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to avoid using AxiosURLSearchParams directly for custom serialization. Instead, utilize the standard Axios request flow, which does not trigger this vulnerability. For example, use the buildURL function to handle URL parameters safely.
Conclusion
The CVE-2026-42040 vulnerability in Axios presents a low-severity risk due to improper encoding in the AxiosURLSearchParams component. Users are encouraged to update to the latest patched versions to mitigate this risk. For those unable to upgrade immediately, utilizing alternative methods for URL parameter handling is recommended.
See every vulnerability recorded for axios →
FAQ
The vulnerability is a null byte injection issue caused by improper encoding in the AxiosURLSearchParams component.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities using your package-lock.json.
The primary impacts include URL truncation and possible bypass of security mechanisms in C-based backends if null bytes are processed incorrectly.
Yes, a patch is available in versions 1.15.1 and above for Axios 1.x, and 0.31.1 for Axios 0.x.
If you cannot upgrade, avoid using AxiosURLSearchParams directly and use the standard Axios request flow instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
