PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-42041

CVE-2026-42041

axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling

Loading…

Severity

Important

Red Hat Product Security

8.2

CVSS 3.1

Review impact separately from score.

Published · April 25, 2026

Updated · November 5, 2026

Description

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the Object.prototype.validateStatus property. By polluting this property, all HTTP error responses (such as 401, 403, or 500) are silently treated as successful responses. This can lead to a complete bypass of application-level authentication and error handling, potentially granting unauthorized access.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes