CVE-2026-42040

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.31.1 Axios versions prior to 1.15.1

Description The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) that reverses the safe percent-encoding of null bytes. While encodeURIComponent('x00') produces the safe sequence %00, the charMap entry '%00': 'x00' converts it back to a raw null byte. The primary impact is limited as the standard request flow is not affected.

Recommendations Update to version 0.31.1. Update to version 1.15.1.