CVE catalog

CVE-2026-42264

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParse

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.77% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-axiossid1.20.0-1fixed
Debiannode-axiosforky1.20.0-1fixed
Debiannode-axiostrixie1.8.4+dfsg-1vulnerable
Debiannode-axiosbookworm1.2.1+dfsg-1+deb12u1vulnerable
Cpenode-axiosNot reportedNot reportedvulnerable
CpeaxiosNot reported1.15.2fixed
Ubuntunode-axiosnoble1.6.8+dfsg-2ubuntu0.1~esm1fixed
CpeaxiosNot reported1.15.2fixed
Ubuntunode-axiospro1.11.0+dfsg-1vulnerable
Ubuntunode-axiospro1.12.1+dfsg-1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1build1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1ubuntu0.1~esm1fixed
Ubuntunode-axios25.101.7.9+dfsg-1vulnerable
Ubuntunode-axios25.101.8.4+dfsg-1vulnerable
Ubuntunode-axios25.101.11.0+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-axiossourcesid1.15.2-1not yet assignedNot reportedNot reported
Debiannode-axiossourceforky1.15.2-1not yet assignedNot reportedNot reported
Debiannode-axiossourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-axiossourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeaxioscpeNot reported1.15.2Not reportedNot reportedNot reported
Ubuntunode-axiosdebnoble1.6.8+dfsg-2ubuntu0.1~esm1Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.15.2Not reportedNVD-CVE-2026-42264Not reported
Ubuntunode-axiosdebpro1.13.2+dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2026-42264Not reported

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-axios]Affected
    Details (2)

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

[Debian 13 (Trixie)]

  • [node-axios]Affected
    Details (2)

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]