Prototype Pollution

🗓️ 24 Apr 2026 19:21:23Reported by Snyk Security DatabaseType

Prototype pollution in Axios via mergeDirectKeys pollutes Object.prototype, enabling inherited values like validateStatus to bypass error handling.

Reporter	Title	Published	Views	Family All 91
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035	29 May 202610:24	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Axios	5 Jun 202609:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037	29 May 202607:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple axios vulnerabilities (CVE-2026-42033 through CVE-2026-42044).	2 Jun 202611:26	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in axios	21 May 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses axios-1.15.0.tgz which is vulnerable to multiple CVEs.	1 Jun 202607:54	–	ibm
ATTACKERKB	CVE-2026-42041	24 Apr 202617:55	–	attackerkb
Chainguard	CVE-2026-42041 vulnerabilities	5 May 202619:17	–	cgr
Circl	CVE-2026-42041	5 May 202605:10	–	circl
CNNVD	Axios 授权问题漏洞	24 Apr 202600:00	–	cnnvd