Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

🗓️ 05 May 2026 00:21:39Reported by GitHub Advisory DatabaseType

Axios prototype pollution in validateStatus merge strategy bypasses authentication by treating all errors as success.

Reporter	Title	Published	Views	Family All 71
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035	29 May 202610:24	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Axios	15 May 202609:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037	29 May 202607:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple axios vulnerabilities (CVE-2026-42033 through CVE-2026-42044).	2 Jun 202611:26	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in axios	21 May 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses axios-1.15.0.tgz which is vulnerable to multiple CVEs.	1 Jun 202607:54	–	ibm
ATTACKERKB	CVE-2026-42041	24 Apr 202617:55	–	attackerkb
Chainguard	CVE-2026-42041 vulnerabilities	5 May 202619:17	–	cgr
Circl	CVE-2026-42041	5 May 202605:10	–	circl
CNNVD	Axios 授权问题漏洞	24 Apr 202600:00	–	cnnvd

Vulners

Node

axios axiosRange≤0.31.0npm

axios axiosRange1.0.0–1.15.1npm

Source	Link
github	www.github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42041
github	www.github.com/advisories/GHSA-w9j2-pvgh-6h63

05 May 2026 00:21Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.8 - 6.5

EPSS0.00148

SSVC