CVE-2026-42042: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42042 is a XSRF token cross-origin leakage vulnerability in the Axios HTTP client library, caused by a prototype pollution gadget in the withXSRFToken boolean coercion logic. The flaw affects Axios versions prior to 1.15.1 (for the 1.x branch) and prior to 0.31.1 (for the 0.x branch), impacting browser-based environments using Axios for Node.js. It was discovered on April 15, 2026 via source code audit and publicly disclosed on April 24, 2026 via GitHub Security Advisory GHSA-xx6v-rp6x-q39c. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Github Advisory).

The root cause lies in lib/helpers/resolveConfig.js (lines 57–66), where the withXSRFToken config property is evaluated using JavaScript truthy/falsy semantics rather than strict boolean comparison (CWE-183, CWE-201). The vulnerable condition if (withXSRFToken || (withXSRFToken !== false && isURLSameOrigin(newConfig.url))) short-circuits the isURLSameOrigin() same-origin check whenever withXSRFToken is any truthy non-boolean value (e.g., 1, "false", {}, []), causing the XSRF token to be attached as a request header (X-XSRF-TOKEN) to all outgoing requests regardless of destination origin. This can be triggered via prototype pollution — if an attacker can set Object.prototype.withXSRFToken = 1 through a vulnerable dependency, every Axios request in the application inherits the polluted value — or through developer misconfiguration (e.g., setting withXSRFToken: "false" as a string instead of a boolean). The vulnerability is browser-only, as the XSRF logic only executes when hasStandardBrowserEnv is true (GitHub Advisory).

Successful exploitation causes the victim's XSRF anti-CSRF token to be leaked to attacker-controlled cross-origin servers via the X-XSRF-TOKEN request header, enabling the attacker to bypass CSRF protections and forge authenticated requests on behalf of the victim user. This results in low confidentiality impact (token exposure) and low integrity impact (unauthorized state modification via CSRF), with no availability impact. Notably, XSRF tokens are anti-CSRF tokens rather than session tokens, so direct session hijacking is not possible; however, a single prototype pollution of Object.prototype.withXSRFToken affects every Axios request across the entire application, broadening the attack surface significantly (GitHub Advisory, Github Advisory).

1. Identify a prototype pollution vector: Find a vulnerable JavaScript dependency in the target application that allows setting arbitrary properties on Object.prototype (e.g., via a JSON merge or deep-clone gadget chain).
2. Pollute the prototype: Exploit the prototype pollution vulnerability to set Object.prototype.withXSRFToken = 1 (or any other truthy non-boolean value such as "true", {}, or []) in the victim's browser context.
3. Lure the victim: Trick the victim user into visiting a page or triggering an action that causes the vulnerable Axios-based application to make HTTP requests (e.g., via a phishing link or malicious advertisement).
4. Capture the XSRF token: Host an attacker-controlled server (e.g., https://attacker.com/collect) and observe incoming requests — due to the short-circuited same-origin check, Axios will include the X-XSRF-TOKEN: <victim-token> header in cross-origin requests to the attacker's server.
5. Forge CSRF requests: Use the captured XSRF token to craft forged requests to the victim application, bypassing its CSRF protection and performing unauthorized actions on behalf of the victim (GitHub Advisory).

• Network: Outbound HTTP requests from a browser to unexpected cross-origin domains containing the X-XSRF-TOKEN header; requests to attacker-controlled endpoints with CSRF token values in headers.
• Logs: Application or proxy logs showing Axios-generated requests to external/cross-origin URLs with X-XSRF-TOKEN headers present where same-origin enforcement is expected.
• JavaScript Runtime: Detection of Object.prototype.withXSRFToken being set to a non-boolean truthy value (e.g., 1, "false", {}) during runtime inspection or via browser developer tools; unexpected properties on Object.prototype indicative of prototype pollution.

Upgrade Axios to version 1.15.1 (for 1.x users) or 0.31.1 (for 0.x users), which implement strict boolean comparison (withXSRFToken === true) to fix the coercion flaw (GitHub Advisory). As interim mitigations: ensure withXSRFToken is always explicitly set to a strict boolean (true or false) rather than a string or other truthy value in application configurations; implement Content Security Policy (CSP) headers to restrict where tokens can be sent; and conduct a prototype pollution assessment on all application dependencies to identify and remediate gadget chains. IBM has issued advisories for multiple affected products (App Connect Enterprise, Maximo Application Suite, Cloud Pak for Integration, Voice Gateway, and others) and users of those products should apply the respective IBM security bulletins (IBM ACE Advisory, IBM Cloud Pak Advisory).

IBM issued multiple security bulletins across its product portfolio (including App Connect Enterprise, Maximo Application Suite, Cloud Pak for Integration, Voice Gateway, watsonx Code Assistant, and IBM InfoSphere Optim Archive Viewer) acknowledging the impact of CVE-2026-42042 and related Axios CVEs, reflecting broad downstream concern about the vulnerability's reach in enterprise software (IBM ACE Advisory, IBM InfoSphere Advisory). The vulnerability was detected by Qualys (detection ID 387394) and noted in Tenable Nessus plugins, indicating uptake among vulnerability management vendors. Community discussion on Mastodon referenced the issue, though overall social media reaction has been moderate given the Medium severity rating.