CVE-2026-42035: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42035 is a prototype pollution gadget vulnerability in the Axios HTTP client (npm package) that enables arbitrary HTTP header injection into outgoing requests. It affects all Axios versions prior to 1.15.1 (1.x branch) and prior to 0.31.1 (0.x branch) for Node.js. The vulnerability was disclosed on April 24, 2026, by researcher raulvdv via the GitHub Security Advisory GHSA-6chq-wfr3-2hj9, with patches released the same day. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Github Advisory).

The root cause is a combination of CWE-1321 (Prototype Pollution) and CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). The vulnerable code in lib/adapters/http.js uses duck-type checking to detect FormData payloads: it calls utils.isFormData(data) (which checks for append, Symbol.toStringTag === 'FormData', and toString()) and then utils.isFunction(data.getHeaders). If an attacker can pollute Object.prototype with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object as a FormData instance and calls the attacker-controlled getHeaders() function, merging its return value into the outgoing request headers. Critically, the prototype pollution source need not originate in Axios itself — any deep-merge utility in the dependency tree (e.g., lodash.merge, qs, JSON5) that processes attacker-controlled input is sufficient to trigger this gadget. The fix requires adding an explicit own-property check: Object.prototype.hasOwnProperty.call(data, 'getHeaders') (GitHub Advisory).

Successful exploitation allows an attacker to inject arbitrary HTTP headers into any Axios-initiated POST, PUT, or PATCH request, enabling authentication bypass (by overriding Authorization headers), session fixation, privilege escalation, IP spoofing, and WAF bypass. In microservice architectures where downstream services trust identity headers (e.g., X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream gateways, injected headers can cross trust boundaries and compromise services beyond the directly vulnerable component. Confidentiality and integrity are both rated High; availability is not directly impacted (GitHub Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating prototype pollution of Object.prototype followed by an axios.post() call that transmits attacker-injected headers to a target endpoint (GitHub Advisory). Feedly's threat intelligence classifies the PoC confidence as high and notes it is a real exploit, not merely a local demonstration. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.033–0.047%, placing it in the 15th percentile for exploitation likelihood. Exploitation requires a pre-existing prototype pollution primitive elsewhere in the application's dependency tree, raising the attack complexity to High.

1. Identify a prototype pollution primitive: Audit the target application's dependency tree for packages that perform unsafe deep merges on attacker-controlled input (e.g., lodash.merge, qs, JSON5, or custom deep-merge utilities). Confirm that user-supplied data flows into one of these sinks.
2. Trigger prototype pollution: Craft a malicious input payload that causes the vulnerable dependency to set properties on Object.prototype. The required properties are: Symbol.toStringTag = 'FormData', append (a function), getHeaders (a function returning desired headers), pipe (a function), on (a function), and once (a function).

   Object.prototype[Symbol.toStringTag] = 'FormData';
   Object.prototype.append = () => {};
   Object.prototype.getHeaders = () => ({ 'X-Role': 'admin', 'Authorization': 'Bearer ATTACKER_TOKEN' });
   Object.prototype.pipe = function(d) { if(d&&d.end)d.end(); return d; };
   Object.prototype.on = function() { return this; };
   Object.prototype.once = function() { return this; };

3. Wait for or trigger an Axios HTTP request: The application must make a POST, PUT, or PATCH request via Axios with a plain object as the data payload. This can be triggered by any normal application action that invokes such a request.
4. Header injection occurs: Axios's isFormData() duck-type check passes on the plain object (due to polluted prototype), and getHeaders() is called, merging the attacker-controlled headers into the outgoing request — overriding or supplementing legitimate headers such as Authorization.
5. Achieve objective: The downstream service receives the request with injected headers, potentially granting the attacker elevated privileges, bypassing authentication, or circumventing WAF/IP-based controls (GitHub Advisory).

• Logs: Unexpected or duplicate HTTP headers (e.g., Authorization, X-Role, X-User-ID, X-Tenant-ID) appearing in outbound requests from Node.js services using Axios; application logs showing requests to internal APIs with headers inconsistent with the originating user's privileges.
• Application Behavior: Downstream services receiving requests with identity or role headers that were not set by the application's own authentication logic; privilege escalation events in downstream microservices correlated with Axios-based upstream calls.
• Code/Dependency Artifacts: Presence of known prototype-pollution-vulnerable packages (e.g., lodash < 4.17.21, qs < 6.10.3, json5 < 2.2.2) alongside Axios versions < 1.15.1 or < 0.31.1 in package-lock.json or yarn.lock.
• Runtime: Unexpected properties on Object.prototype detectable via runtime inspection (e.g., Object.prototype.getHeaders, Object.prototype.append, Object.prototype[Symbol.toStringTag] === 'FormData') in Node.js process memory or via security monitoring tools.

Upgrade Axios to version 1.15.1 (for the 1.x branch) or 0.31.1 (for the 0.x branch), which add an explicit own-property check (Object.prototype.hasOwnProperty.call(data, 'getHeaders')) to prevent polluted prototype properties from being used in header merging (GitHub Advisory). Additionally, audit the full dependency tree for prototype pollution vulnerabilities in other packages (e.g., lodash.merge, qs, JSON5) and remediate those, as any such primitive can serve as a trigger for this gadget. IBM has issued advisories for numerous affected products including App Connect Enterprise, Maximo Application Suite, Cloud Pak for Integration, Voice Gateway, watsonx Code Assistant, and others — users of these products should apply the relevant IBM security bulletins (IBM Advisory). As a defense-in-depth measure, consider using Object.freeze(Object.prototype) in security-sensitive Node.js applications to prevent prototype pollution entirely.

IBM issued multiple security bulletins across its product portfolio (App Connect Enterprise, Maximo Application Suite, Cloud Pak for Integration, Voice Gateway, watsonx Code Assistant, Quantum Safe Explorer, License Metric Tool, Aspera Enterprise WebApps, Edge Application Manager, InfoSphere Optim Archive Viewer, and others) acknowledging the impact of CVE-2026-42035 (IBM Advisory). Red Hat also published multiple errata (RHSA-2026:14937, RHSA-2026:16476, RHSA-2026:16535, RHSA-2026:16542, RHSA-2026:17657, RHSA-2026:21338, RHSA-2026:24471, RHSA-2026:25041, RHSA-2026:25089) addressing the vulnerability in its products. The advisory notes a potential argument for elevating the CVSS scope to Changed (which would yield a score of 10.0) in microservice architectures, a point that generated discussion in the security community about the real-world severity in service-mesh environments (GitHub Advisory).