Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
3376 articles · 142302 vulns · 36/41 feeds (7d)
← Back to list
6.5
CVE-2026-42044EXPLOITEDPATCHED
axios · axios

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Description

A vulnerability identified as problematic has been detected in Axios up to 1.15.1. This affects an unknown part in the library lib/defaults/index.js. This manipulation causes dynamically-determined object attributes.

Affected Products

VendorProductVersions
axiosaxiosnpm/axios: >= 1.0.0, < 1.15.2

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
ibmapp connect enterprisecert_advisory90%

References

  • https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23(x_refsource_CONFIRM)

Related News (2 articles)

Tier B
BSI Advisories12h ago
[NEU] [mittel] IBM App Connect Enterprise (Axios): Mehrere Schwachstellen
→ No new info (linked only)
Tier C
VulDB17d ago
CVE-2026-42044 | Axios up to 1.15.1 lib/defaults/index.js dynamically-determined object attributes (GHSA-3w6x-2g7m-8v23)
→ No new info (linked only)
CVSS 3.16.5 MEDIUM
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
axios@1.15.2
CWECWE-915, CWE-1321
PublishedApr 24, 2026
Last enriched17d agov2
Trending Score59
Source articles2
Independent2
Info Completeness8/14
Missing: epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

MEDIUMCVE-2026-42034EXP
Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
Trending: 68
HIGHCVE-2026-42035EXP
Axios: Header Injection via Prototype Pollution
Trending: 67
HIGHCVE-2026-42033EXP
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Trending: 67
MEDIUMCVE-2026-42038EXP
Axios: no_proxy bypass via IP alias allows SSRF
Trending: 59
MEDIUMCVE-2026-42041EXP
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Trending: 59

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Apr 24, 2026
Discovered by ZDM
Apr 24, 2026
Actively Exploited
Apr 24, 2026
Patch Available
Apr 24, 2026
Updated: description, affectedVersions, severity, activelyExploited
Apr 24, 2026

Version History

v2
Last enriched 17d ago
v2Tier C17d ago

Updated description with new details, changed affected versions to include 1.15.1, and updated severity to HIGH.

descriptionaffectedVersionsseverityactivelyExploited
via VulDB
v117d ago

Initial creation