CVE-2026-42044: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42044 is a Prototype Pollution "Gadget" vulnerability in the Axios HTTP client library (npm) that enables invisible, surgical tampering of all JSON API responses processed by the library. Affecting Axios versions 1.0.0 through 1.15.1, the flaw allows any Object.prototype pollution elsewhere in an application's dependency tree to be escalated into privilege escalation, balance manipulation, authorization bypass, and silent data exfiltration. The vulnerability was discovered on April 16, 2026, via source code audit and publicly disclosed on April 24, 2026. NVD assigns a CVSS v3.1 base score of 9.1 (Critical), while the CNA (GitHub) rates it 6.5 (Medium) due to higher assessed attack complexity (GitHub Advisory, Github Advisory DB).

The root cause (CWE-1321, CWE-915) lies in lib/defaults/index.js at line 124, where the default transformResponse function calls JSON.parse(data, this.parseReviver) with this being the merged Axios config object. Because parseReviver is absent from Axios defaults, not iterated by mergeConfig, and not validated by assertOptions, a polluted Object.prototype.parseReviver function is silently inherited via the prototype chain and invoked for every key-value pair in every JSON response. Unlike other Axios prototype pollution gadgets (e.g., transformResponse, proxy), this gadget imposes no constraints on return values, enabling selective per-key modification while leaving the response structure intact and generating no errors or crashes. Exploitation requires a pre-existing prototype pollution primitive in any dependency (e.g., qs, minimist, lodash, body-parser) — no direct user input or configuration error in the application's own code is needed (GitHub Advisory).

Successful exploitation allows an attacker to silently modify any JSON value in every Axios-processed API response — demonstrated in the public PoC as flipping isAdmin: false → true, role: "viewer" → "admin", canDelete: false → true, and balance: 100 → 999999. Simultaneously, the reviver receives original pre-modification values, enabling silent exfiltration of API keys, tokens, PII, and other sensitive data from all JSON responses. Because the response structure remains intact and no errors are generated, the attack is entirely invisible to application logs and monitoring, making detection extremely difficult. Downstream IBM products including App Connect Enterprise, Cloud Pak for Integration, Maximo Application Suite, Voice Gateway, and others are also affected (GitHub Advisory, IBM ACE Advisory).

A complete, runnable JavaScript proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating selective response tampering and silent data exfiltration with verified output (GitHub Advisory). The vulnerability is detectable by Nessus (plugin 310518) and Qualys (detection 387394). The EPSS score is approximately 0.03% (Feedly data) to 0.188% (GitHub Advisory DB), indicating low but non-zero near-term exploitation probability. There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory DB).

1. Identify a prototype pollution primitive: Find a dependency in the target application's stack (e.g., qs, minimist, lodash, body-parser) that allows Object.prototype pollution via user-controlled input (e.g., a query string parameter like ?__proto__[parseReviver]=... or a JSON body with {"__proto__": {"parseReviver": ...}}).
2. Craft the pollution payload: Construct a malicious parseReviver function on Object.prototype that selectively modifies target JSON keys and/or exfiltrates values:

Object.prototype.parseReviver = function(key, value) {
  if (key && typeof value !== 'object') stolen[key] = value; // exfiltrate
  if (key === 'isAdmin') return true;
  if (key === 'role') return 'admin';
  if (key === 'balance') return 999999;
  return value;
};

3. Trigger the pollution: Submit the crafted input to any endpoint in the target application that processes it through a vulnerable library, causing Object.prototype.parseReviver to be set in the Node.js process.
4. Wait for Axios JSON responses: Once Object.prototype is polluted, every subsequent axios.get() / axios.post() call that receives a JSON response will automatically invoke the attacker's reviver via JSON.parse(data, this.parseReviver) in lib/defaults/index.js:124.
5. Achieve objective: The application now receives tampered JSON responses (e.g., elevated privileges, approved transactions, bypassed MFA), while the attacker simultaneously receives exfiltrated original values — all with no errors, no crashes, and no visible anomalies in application logs (GitHub Advisory).

• Logs: Application logs showing normal-looking API responses with subtly altered authorization or financial values (e.g., isAdmin: true for known non-admin users, unexpectedly high balances); absence of errors or stack traces despite behavioral anomalies.
• Process/Runtime: Presence of Object.prototype.parseReviver set on the global prototype in a Node.js process (detectable via runtime inspection or heap dumps); unexpected prototype chain modifications on plain config objects.
• Network: Outbound connections from the application server to attacker-controlled endpoints carrying exfiltrated JSON key-value pairs (API keys, tokens, PII) — these may appear as normal HTTPS requests with encoded payloads.
• File System / Dependencies: Presence of Axios npm package versions >= 1.0.0 and < 1.15.2 in node_modules/axios/package.json; co-presence of known prototype-pollution-vulnerable libraries (qs < 6.10.3, minimist < 1.2.6, lodash < 4.17.21) in the dependency tree.
• Behavioral: Privilege escalation events or financial transaction approvals that are inconsistent with server-side authorization logic; MFA bypass or account unlock events without corresponding server-side state changes (GitHub Advisory).

Primary fix: Upgrade Axios to version 1.15.2 or later, which addresses this vulnerability by ensuring parseReviver is only used when explicitly set as an own property of the config object (GitHub Advisory). As a temporary workaround, apply a hasOwnProperty guard before using parseReviver in lib/defaults/index.js: const reviver = Object.prototype.hasOwnProperty.call(this, 'parseReviver') ? this.parseReviver : undefined; return JSON.parse(data, reviver);. A comprehensive fix is to use Object.create(null) for the merged config in mergeConfig.js, eliminating prototype chain traversal for all config properties. IBM product users should apply the relevant security bulletins for App Connect Enterprise, Cloud Pak for Integration, Maximo Application Suite, Voice Gateway, and other affected products (IBM ACE Advisory, IBM CP4I Advisory). Additionally, audit and patch all prototype-pollution-vulnerable dependencies in the application stack to eliminate the prerequisite pollution primitive.

The Axios maintainer (jasonsaayman) published the security advisory on April 24, 2026, and released the fix in version 1.15.2 (GitHub Advisory). IBM issued over a dozen security bulletins across its product portfolio (App Connect Enterprise, Cloud Pak for Integration, Maximo Application Suite, Voice Gateway, watsonx Code Assistant, and others) acknowledging the impact of this and related Axios CVEs (IBM ACE Advisory). The Western Australian Government's SOC published an advisory flagging the Axios vulnerabilities as critical (WA SOC Advisory). Community discussion on Mastodon noted the vulnerability's stealth characteristics, and Red Hat issued multiple errata (RHSA-2026:16535, RHSA-2026:16542, and others) addressing the issue in affected products.