CVE-2026-42033

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.31.1 Axios versions prior to 1.15.1

Description An issue exists where the software reads keys from Object.prototype without a hasOwnProperty guard. If a co-dependency pollutes the Object.prototype, an attacker can silently intercept and modify every JSON response before the application processes it, or fully hijack the underlying HTTP transport to gain access to request credentials, headers, and the body. This requires prototype pollution from a separate source within the same process.

Recommendations Update to version 0.31.1 Update to version 1.15.1