CVE-2026-42041

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.15.1 Axios versions prior to 0.31.1

Description The library is susceptible to a Prototype Pollution Gadget attack. This occurs because the validateStatus configuration property utilizes the mergeDirectKeys merge strategy, which employs the JavaScript in operator that traverses the prototype chain. If Object.prototype.validateStatus is polluted with () => true, all HTTP error responses (such as 401, 403, and 500) are treated as successful responses, effectively bypassing application-level authentication and error handling.

Recommendations Update to version 1.15.1 or later. Update to version 0.31.1 or later.