Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-42035— Axios: Header Injection via Prototype Pollution

Quick assessment

Affected

axios axios

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Axios是Axios开源的一款基于Promise（异步编程的一种解决方案）的HTTP客户端。 Axios 1.15.1之前版本和0.31.1之前版本存在注入漏洞，该漏洞源于Axios HTTP适配器中存在原型污染小工具，允许攻击者向传出请求注入任意HTTP标头。

CVSS 7.4 · High EPSS 0.40% · P34 Updated Apr 25, 2026

Possible ATT&CK Techniques 2 AI

T1574.006 · Dynamic Linker Hijacking T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-42035

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Axios: Header Injection via Prototype Pollution

Source: CVE Program / CVE List V5

Vulnerability Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

HTTP头部中CRLF序列转义处理不恰当(HTTP响应分割)

Source: CVE Program / CVE List V5

Vulnerability Title

Axios 注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
axios	axios	>= 1.0.0, < 1.15.1	-

II. Public POCs for CVE-2026-42035

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-42035

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-42035 (1)

🔗 Header Injection via Prototype Pollution · Advisory · axios/axios · GitHub Read full article x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-42035

Same Patch Batch · axios · 2026-04-24 · 12 CVEs total

CVE-2026-42033	7.4 HIGH	Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hi
CVE-2026-42043	7.2 HIGH	Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loop
CVE-2026-42039	6.9 MEDIUM	Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
CVE-2026-42038	6.8 MEDIUM	Axios: no_proxy bypass via IP alias allows SSRF
CVE-2026-42044	6.5 MEDIUM	Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
CVE-2026-42042	5.4 MEDIUM	Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` B
CVE-2026-42037	5.3 MEDIUM	Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToS
CVE-2026-42034	5.3 MEDIUM	Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
CVE-2026-42036	5.3 MEDIUM	Axios: HTTP adapter streamed responses bypass maxContentLength
CVE-2026-42041	4.8 MEDIUM	Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Stra
CVE-2026-42040	3.7 LOW	Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

IV. Related Vulnerabilities

Same product: axios

Same vendor: axios

Same weakness: CWE-113