CVE-2026-42040: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42040 is a null byte injection vulnerability in the Axios HTTP client library for Node.js and browsers, classified as "Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams." The flaw exists in the encode() function within lib/helpers/AxiosURLSearchParams.js, where a charMap entry ('%00': '\x00') incorrectly converts a safely percent-encoded null byte back into a raw null byte. Affected versions include axios 1.0.0 through 1.15.0 and all versions prior to 0.31.1. The vulnerability was discovered on April 15, 2026, and publicly disclosed on April 24, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Axios Advisory).

The root cause is classified under CWE-626 (Null Byte Interaction Error / Poison Null Byte) and CWE-116 (Improper Encoding or Escaping of Output). The encode() function in AxiosURLSearchParams.js applies a charMap replacement after encodeURIComponent() runs; while all other entries in charMap encode in the safe direction (literal → percent-encoded), the single entry '%00': '\x00' reverses the encoding, converting the safe %00 sequence back to a raw null byte (\x00). Exploitation requires either direct use of AxiosURLSearchParams.toString() without an external encoder, or a custom paramsSerializer.encode that delegates to the internal encoder — the standard buildURL flow is not affected because it passes its own encoder to AxiosURLSearchParams, bypassing the vulnerable charMap. A public proof-of-concept demonstrating the vulnerable path is included in the official advisory (Axios Advisory).

The primary integrity impact is low and scoped to the HTTP request URL; there is no confidentiality or availability impact. If raw null bytes reach a downstream C-based URL parser or backend, potential consequences include URL truncation (where the string is terminated at the null byte), WAF bypass (security controls may not inspect content after the null byte), and log injection. The standard axios request flow is not affected, limiting the real-world attack surface to applications that directly instantiate AxiosURLSearchParams or use custom paramsSerializer configurations that delegate to the internal encoder (GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit or exploit kit is known to leverage this vulnerability. The Feedly analysis classifies the referenced PoC as non-exploitable against real deployments, noting it demonstrates the bug through local library calls without network attack vectors (Axios Advisory). The EPSS score is approximately 0.029% (Feedly data) to 0.083% (GitHub Advisory), placing it in a low exploitation-probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is associated with this CVE.

1. Identify vulnerable usage: Determine if the target application uses AxiosURLSearchParams directly (e.g., new AxiosURLSearchParams({...}).toString() without an encoder argument) or employs a custom paramsSerializer.encode that internally delegates to axios's encode function.
2. Craft a null-byte-containing input: Prepare a parameter value containing a null byte, e.g., { file: 'test\x00.txt' }.
3. Trigger the vulnerable code path: Pass the crafted parameter to AxiosURLSearchParams and call .toString() without providing an external encoder. The internal charMap will convert the safely encoded %00 back to a raw \x00.
4. Deliver to a vulnerable downstream parser: If the resulting URL string (containing a raw null byte) is forwarded to a C-based backend or parser, the null byte may truncate the URL, bypass WAF rules, or inject content into logs — e.g., a request for file=test\x00.txt may be interpreted as file=test by a C parser (Axios Advisory).

Update axios to version 1.15.1 (for the 1.x branch) or 0.31.1 (for the 0.x branch), which remove the '%00': '\x00' entry from charMap and update the replacement regex accordingly. As a workaround for applications that cannot immediately upgrade, avoid direct use of AxiosURLSearchParams.toString() without an external encoder, and ensure custom paramsSerializer.encode implementations do not delegate to the internal axios encoder. Review any code that constructs URLs with user-controlled parameters to ensure null bytes are not passed through to downstream parsers (Axios Advisory, GitHub Advisory).

IBM issued multiple security bulletins acknowledging the impact of CVE-2026-42040 on a wide range of its products that bundle axios, including IBM App Connect Enterprise, IBM Maximo Application Suite, IBM Cloud Pak for Integration, IBM Voice Gateway, IBM watsonx Code Assistant, IBM Business Automation Manager Open Editions, IBM License Metric Tool, IBM Edge Application Manager, IBM Aspera Enterprise WebApps, and IBM InfoSphere Optim Archive Viewer (IBM ACE Advisory, IBM Maximo Advisory). The vulnerability was reported by security researcher August829 via GitHub Security Advisory. Community reaction has been muted given the low severity rating and limited exploitability of the standard axios request flow.