Lucene search
+L

5008 matches found

UbuntuCve
UbuntuCve
added 2026/04/24 6:16 p.m.12 views

CVE-2026-42033

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before the...

7.4CVSS5.7AI score0.00838EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve
added 2026/04/24 6:16 p.m.13 views

CVE-2026-42037

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF \r\n sequences. An attacker w...

5.3CVSS5.9AI score0.00294EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve
added 2026/04/24 6:16 p.m.9 views

CVE-2026-42043

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range other than 127.0.0.1 to completely bypass the NOPROXY protection. This vulnerability is due t...

10CVSS5.8AI score0.00661EPSS
SaveExploits1References3
UbuntuCve
UbuntuCve
added 2026/04/24 6:16 p.m.12 views

CVE-2026-42039

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and...

7.5CVSS5.8AI score0.00744EPSS
SaveExploits1References2
OSV
OSV
added 2026/04/24 6:16 p.m.17 views

UBUNTU-CVE-2026-42044

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible...

9.1CVSS5.8AI score0.00586EPSS
SaveExploits1References4
OSV
OSV
added 2026/04/24 6:03 p.m.7 views

CVE-2026-42042 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy...

5.4CVSS5.9AI score
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/04/24 6:03 p.m.4 views

CVE-2026-42042 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy...

5.4CVSS5.3AI score0.00228EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/04/24 6:03 p.m.7 views

CVE-2026-42042

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy...

5.4CVSS5.3AI score0.00228EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/04/24 6:03 p.m.150 views

CVE-2026-42042

Axios is affected by a cross-origin leakage due to XSRF token handling when withXSRFToken is set to truthy non-boolean values. Prior to versions 1.15.1 and 0.31.1, the protection logic used truthy/falsy semantics instead of strict boolean comparison, short-circuiting the isURLSameOrigin check and...

5.4CVSS5.3AI score0.00228EPSS
SaveExploits1References1Affected Software1
Debian CVE
Debian CVE
added 2026/04/24 6:03 p.m.11 views

CVE-2026-42042

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy...

5.4CVSS5.3AI score0.00228EPSS
SaveExploits1
Cvelist
Cvelist
added 2026/04/24 6:03 p.m.55 views

CVE-2026-42042 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy...

5.4CVSS0.00228EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2026/04/24 6:01 p.m.6 views

CVE-2026-42039 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and...

6.9CVSS5.2AI score0.00744EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2026/04/24 6:01 p.m.80 views

CVE-2026-42039 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and...

6.9CVSS0.00744EPSS
SaveExploits1References1
CVE
CVE
added 2026/04/24 6:01 p.m.139 views

CVE-2026-42039

CVE-2026-42039 affects Axios’ toFormData function, where passing deeply nested request data can trigger unbounded recursion and crash the Node.js process with a RangeError. Affected versions are before 1.15.1 and 0.31.1; remediation is to upgrade to 1.15.1 or 0.31.1. The vulnerability impacts Axi...

7.5CVSS5.3AI score0.00744EPSS
SaveExploits1References43Affected Software1
OSV
OSV
added 2026/04/24 6:01 p.m.11 views

CVE-2026-42039 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and...

6.9CVSS6.5AI score
SaveExploits0References45
Debian CVE
Debian CVE
added 2026/04/24 6:01 p.m.14 views

CVE-2026-42039

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and...

7.5CVSS5.3AI score0.00744EPSS
SaveExploits1
CVE
CVE
added 2026/04/24 6:00 p.m.42 views

CVE-2026-42036

Axios is affected when using responseType: 'stream' prior to v1.15.1 and v0.31.1, where the HTTP client returns the response stream without enforcing maxContentLength. This allows unbounded downstream consumption and bypasses configured response-size limits. The issue is fixed in v1.15.1 and v0.3...

5.3CVSS5.3AI score0.00327EPSS
SaveExploits1References1Affected Software1
Cvelist
Cvelist
added 2026/04/24 6:00 p.m.40 views

CVE-2026-42036 Axios: HTTP adapter streamed responses bypass maxContentLength

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This...

5.3CVSS0.00327EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2026/04/24 6:00 p.m.9 views

CVE-2026-42036 Axios: HTTP adapter streamed responses bypass maxContentLength

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This...

5.3CVSS5.2AI score0.00327EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/04/24 6:00 p.m.9 views

CVE-2026-42036

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This...

5.3CVSS5.3AI score0.00327EPSS
SaveExploits1References2Affected Software1
Rows per page
Query Builder