CVE-2026-42044 is a prototype pollution gadget in Axios, scored CVSS 6.5 (medium) in the record. If any other package pollutes Object.prototype, Axios can then alter every JSON response it parses. Upgrade Axios to 1.15.2 and keep the rest of your dependency tree patched.
What's affected
The NVD record lists Axios from 1.0.0 to before 1.15.2, and the fixed version is 1.15.2. The advisory's own table says affected versions are 1.0.0 and later with 1.15.2 as the patch, and its text says all versions including 0.x are exposed, so check the advisory if you still run 0.x.
The flaw is a second stage. It does nothing alone. It needs prototype pollution to already exist somewhere in the same process, in your code or another dependency.
How to check if you're exposed
- Find every copy of Axios.
npm ls axios
npm explain axios
pnpm why axios
yarn why axios
- Anything from 1.0.0 up to 1.15.1 is affected. Check 0.x against the advisory.
- Look for the first stage. Run your usual dependency audit and look for prototype pollution advisories in packages that merge or parse untrusted objects.
npm audit
What to do now
- Upgrade Axios to 1.15.2 or later and rebuild.
- Update dependencies that have prototype pollution advisories, since they are what makes this one usable.
- Treat API responses as untrusted data anyway, and validate fields that drive access decisions on the server side.
Why it matters
The classes are CWE-1321, improperly controlled modification of object prototype attributes, and CWE-915, improperly controlled modification of dynamically determined object attributes. By default Axios parses JSON with a function that reads a reviver setting from its merged configuration. Because that setting is not defined by default, a polluted value on the shared prototype gets picked up and run for each key and value in each response.
The advisory says this lets an attacker change selected values while the response looks normal, which could affect roles or balances. It scored the issue 9.1 itself, while the NVD record says 6.5, and the NVD vector rates attack complexity as high because another flaw is needed first. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
Reachability analysis shows whether a vulnerable function in a dependency can actually be reached from your code.
Click through it at your own pace, or open it full screen.
Quick check
Is this exploitable by itself?
No. The advisory describes it as a gadget, which means it needs prototype pollution from another source in the same process.
Sources
Last reviewed: 19 October 2026.
