CVE-2026-42042 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Prototype pollution allows attackers to bypass same-origin checks, leaking XSRF tokens to cross-origin servers in Axios HTTP clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42042?
CVE-2026-42042 is a medium-severity vulnerability in axios, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.
Which versions are affected by CVE-2026-42042?
4 open source packages ship an affected version, including axios. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
axios npm | All versions | 0.31.1 |
axios npm | All versions | 0.31.1 |
axios npm | From 1.0.0 | 1.15.1 |
axios npm | From 1.0.0 | 1.15.1 |
Products include Axios Axios.
How do I fix CVE-2026-42042?
Upgrade axios to a fixed version for your release line: 0.31.1 or 1.15.1.
Is CVE-2026-42042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42042 exists.
Other vulnerabilities in axios
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2025-27152 Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Sources
Also known as CLEANSTART-2026-BR76038, CLEANSTART-2026-LN42574, DEBIAN-CVE-2026-42042, ECHO-f974-2d2f-b5cf, GHSA-xx6v-rp6x-q39c, MINI-29w3-69vm-c24f and 20 more.