# CVE-2026-42041: axios Auth Bypass β€” Fixed in 1.15.1 πŸ“¦ πŸ“¦ npm Not in CISA KEV MEDIUM severity # CVE-2026-42041 β€” axios MEDIUM CVE-2026-42041 is a medium-severity (CVSS 4.8) Improper Authentication vulnerability in axios. A fix is available for axios β€” see the affected versions and patch details below. Axios: Authentication Bypass via Prototype Pollution Gadget in \`validateStatus\` Merge Strategy Also known as[GHSA-w9j2-pvgh-6h63](/vulnerability/GHSA-w9j2-pvgh-6h63) Published Apr 24, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 2, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42041. ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 0.7%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs51th percentile β€” riskier than 51% of all scored CVEsHighest risk 0.00%0.44%0.87%1.31%0.1%0.7%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 2 pkgs affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 180Kother npm packages depend on this β€” each one inherits the vulnerability until it's patched upstream `axios`npm 144.1Mdownloads / week ## Description ## Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy ### Summary The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any `Object.prototype` pollution to **silently suppress all HTTP error responses** (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that `validateStatus` is the **only** config property using the `mergeDirectKeys` merge strategy, which uses JavaScript's `in` operator β€” an operator that inherently traverses the prototype chain. When `Object.prototype.validateStatus` is polluted with `() => true`, all HTTP status codes are accepted as success. **Severity:** High (CVSS 8.2) **Affected Versions:** All versions (v0.x - v1.x including v1.15.0) **Vulnerable Component:** `lib/core/mergeConfig.js` (`mergeDirectKeys` strategy) + `lib/core/settle.js` ### CWE - **CWE-1321:** Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') - **CWE-287:** Improper Authentication ### CVSS 3.1 **Score: 8.2 (High)** Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N` Metric Value Justification Attack Vector Network PP is triggered remotely Attack Complexity Low Once PP exists, a single property assignment exploits this. Consistent with GHSA-fvcv-3m26-pcqx Privileges Required None No authentication needed User Interaction None No user interaction required Scope Unchanged Impact within the application Confidentiality Low 401 treated as success may expose data behind auth gates Integrity High All error handling and auth checks are silently bypassed β€” application operates on invalid assumptions Availability None The function works correctly (returns true), no crash ### Usage of "Helper" Vulnerabilities This vulnerability requires **Zero Direct User Input**. If an attacker can pollute `Object.prototype` via any other library in the stack, Axios will automatically inherit the polluted `validateStatus` function during config merge. The `in` operator in `mergeDirectKeys` makes this property **uniquely susceptible** to prototype pollution compared to all other config properties. ### Why `validateStatus` Is Uniquely Vulnerable All other config properties use `defaultToConfig2`, which reads `config2[prop]` (traverses prototype). But `validateStatus` uses `mergeDirectKeys`, which uses the `in` operator: ``` // mergeConfig.js:58-64 β€” mergeDirectKeys (ONLY used by validateStatus) function mergeDirectKeys(a, b, prop) { if (prop in config2) { // ← `in` traverses prototype chain! return getMergedValue(a, b); } else if (prop in config1) { return getMergedValue(undefined, a); } } // mergeConfig.js:94 const mergeMap = { // ... all others use defaultToConfig2 ... validateStatus: mergeDirectKeys, // ← ONLY property using this strategy }; ``` The `in` operator is a **more aggressive** prototype traversal than property access. While `config2['validateStatus']` also traverses the prototype, the explicit `in` check makes the intent clearer and the vulnerability more direct. ### Proof of Concept #### 1\. The Setup (Simulated Pollution) ``` Object.prototype.validateStatus = () => true; ``` #### 2\. The Gadget Trigger (Safe Code) ``` // Application checks authentication via HTTP status codes try { const response = await axios.get('https://api.internal/admin/users'); // Developer expects: 401 β†’ catch block β†’ redirect to login // Reality: 401 β†’ treated as success β†’ displays admin data processAdminData(response.data); // Executes with 401 response body! } catch (error) { redirectToLogin(); // NEVER REACHED for 401/403/500 } ``` #### 3\. The Execution ``` // mergeConfig.js:58 β€” 'validateStatus' in config2 // config2 = { url: '/admin/users', method: 'get' } // 'validateStatus' in config2 β†’ checks prototype β†’ finds () => true β†’ TRUE // β†’ getMergedValue(defaultValidator, () => true) β†’ returns () => true // settle.js:16 β€” ALL status codes resolve const validateStatus = response.config.validateStatus; // () => true if (!response.status || !validateStatus || validateStatus(response.status)) { resolve(response); // 401, 403, 500 all resolve here! } ``` #### 4\. The Impact ``` Before pollution: HTTP 200 β†’ resolve (success) HTTP 401 β†’ reject (auth error) β†’ redirectToLogin() HTTP 403 β†’ reject (forbidden) β†’ showAccessDenied() HTTP 500 β†’ reject (server error) β†’ showErrorPage() After pollution: HTTP 200 β†’ resolve (success) HTTP 401 β†’ resolve (SUCCESS!) β†’ processAdminData() with error body HTTP 403 β†’ resolve (SUCCESS!) β†’ application thinks user has access HTTP 500 β†’ resolve (SUCCESS!) β†’ application processes error as data ``` ### Verified PoC Output ``` --- Before Pollution --- 401: REJECTED as expected - Request failed with status code 401 500: REJECTED as expected - Request failed with status code 500 --- After Pollution --- 200: RESOLVED as success (status: 200) 301: RESOLVED as success (status: 301) 401: RESOLVED as success (status: 401) 403: RESOLVED as success (status: 403) 404: RESOLVED as success (status: 404) 500: RESOLVED as success (status: 500) 503: RESOLVED as success (status: 503) --- Authentication Bypass Demo --- Auth check bypassed! 401 treated as success. Application proceeds with: { status: 401, message: 'Response with status 401' } ``` ### Impact Analysis - **Authentication Bypass:** Applications relying on axios rejecting 401/403 to enforce auth will silently accept unauthorized responses, allowing unauthenticated access to protected resources. - **Silent Error Swallowing:** 500-series errors are treated as success, causing applications to process error bodies as valid data β€” leading to data corruption or logic errors. - **Security Control Bypass:** Rate limiting (429), WAF blocks (403), and CAPTCHA challenges are suppressed. - **Universal Scope:** Affects every axios instance in the application, including third-party libraries. ### Recommended Fix Replace the `in` operator with `hasOwnProperty` in `mergeDirectKeys`: ``` // FIXED: lib/core/mergeConfig.js function mergeDirectKeys(a, b, prop) { if (Object.prototype.hasOwnProperty.call(config2, prop)) { return getMergedValue(a, b); } else if (Object.prototype.hasOwnProperty.call(config1, prop)) { return getMergedValue(undefined, a); } } ``` ### Resources - [CWE-1321: Prototype Pollution](https://cwe.mitre.org/data/definitions/1321.html) - [CWE-287: Improper Authentication](https://cwe.mitre.org/data/definitions/287.html) - [GHSA-fvcv-3m26-pcqx: Related PP Gadget in Axios](https://github.com/advisories/GHSA-fvcv-3m26-pcqx) - [MDN: `in` operator](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/in) - [Axios GitHub Repository](https://github.com/axios/axios) ### Timeline Date Event 2026-04-15 Vulnerability discovered during source code audit 2026-04-15 PoC developed and vulnerability confirmed 2026-04-16 Report revised for accuracy TBD Report submitted to vendor via GitHub Security Advisory ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix πŸ“¦npm `axios` β‰₯ 1.0.0&&< 1.15.1 1.15.1`npm install axios@1.15.1` πŸ“¦npm `axios` all versions 0.31.1`npm install axios@0.31.1` ## Affected Products 1 product Β· 2 configurations Application `axios`axios β‰₯ 1.0.0 && < 1.15.1 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for axios, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update axios to 1.15.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2026-42041 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Fixing This On Your OS If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below β€” it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project. Red HatImportant Product Fixed in Advisory HawtIO HawtIO 4.4.0 `axios` [RHSA-2026:25089](https://access.redhat.com/errata/RHSA-2026:25089) Red Hat Data Grid 8.6.1 `axios` [RHSA-2026:22619](https://access.redhat.com/errata/RHSA-2026:22619) multicluster engine for Kubernetes 2.10 `multicluster-engine/console-mce-rhel9:1780917531` [RHSA-2026:24536](https://access.redhat.com/errata/RHSA-2026:24536) multicluster engine for Kubernetes 2.11 `multicluster-engine/console-mce-rhel9:1780910888` [RHSA-2026:25271](https://access.redhat.com/errata/RHSA-2026:25271) multicluster engine for Kubernetes 2.6 `multicluster-engine/console-mce-rhel9:1778511348` [RHSA-2026:17657](https://access.redhat.com/errata/RHSA-2026:17657) multicluster engine for Kubernetes 2.8 `multicluster-engine/console-mce-rhel9:1778383863` [RHSA-2026:17699](https://access.redhat.com/errata/RHSA-2026:17699) multicluster engine for Kubernetes 2.9 `multicluster-engine/console-mce-rhel9:1778532610` [RHSA-2026:19109](https://access.redhat.com/errata/RHSA-2026:19109) Network Observability (NETOBSERV) 1.11.0 `network-observability/network-observability-console-plugin-compat-rhel9:1778508956` [RHSA-2026:16874](https://access.redhat.com/errata/RHSA-2026:16874) ## Frequently Asked Questions \# Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in \`validateStatus\` Merge Strategy ## Summary The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any \`Object.prototype\` pollution to \*\*silently suppress all HTTP error responses\*\* (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that \`validateStatus\` is the \*\*only\*\* config property using the \`mergeDirectKeys\` merge strategy, which uses JavaScript's \`in\` oper O3 Security Β· Impact-Aware SCA ### Is CVE-2026-42041 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)