CVE-2026-42035

What it actually does

This is a prototype-pollution gadget in Axios’ Node.js HTTP adapter. If any other vulnerability or dependency in the application can pollute Object.prototype with specific FormData-like properties, Axios versions before 1.15.1 and 0.31.1 can incorrectly treat an ordinary object request body as FormData. Axios then calls an attacker-controlled getHeaders() function and merges the returned values into the outbound HTTP request. The direct impact is attacker-controlled HTTP header injection on requests made by the affected application, which can compromise confidentiality and integrity of downstream service calls, including authentication headers, routing headers, proxy headers, tenant-selection headers, or security-control bypass headers. The vulnerable code is in lib/adapters/http.js, so the primary exposure is server-side Node.js use of Axios’ HTTP adapter rather than normal browser-only usage.

Why it matters to the business

Applications using vulnerable Axios versions may send attacker-manipulated requests to internal or external services, potentially exposing data, bypassing access controls, impersonating trusted services, or causing transactions to be processed with forged context. The issue is especially important in API-heavy Node.js services because Axios is widely used both directly and transitively; a vulnerable transitive copy can remain present even after top-level dependencies appear updated. Although public exploit maturity and EPSS are currently low and it is not listed in CISA KEV, the impact can be serious where outbound Axios requests carry credentials, tokens, cookies, customer data, payment instructions, administrative API calls, or service-to-service trust headers.

How an attack unfolds

An attacker first needs a prototype-pollution primitive somewhere in the application or its dependency tree; Axios does not need to be the component that performs the pollution. Through that primitive, the attacker adds FormData-like properties such as getHeaders, append, pipe, on, once, and Symbol.toStringTag to Object.prototype. When the application later uses vulnerable Axios in Node.js to send an HTTP request with a plain object payload, Axios’ duck-typing logic misclassifies that object as FormData. Axios invokes the polluted getHeaders() function and trusts its returned header map. Those attacker-supplied headers are merged into the outbound request, allowing the attacker to alter how the receiving service interprets the request. Depending on the application’s architecture, this can be used to inject or override authorization, cookies, host/routing metadata, forwarding headers, API keys, method-override headers, or other security-sensitive headers used by downstream services.

How to fix it

Upgrade Axios to a fixed version: 1.15.1 or later for the 1.x line, or 0.31.1 or later for the 0.x line. Update all direct and transitive Axios copies in package-lock.json, yarn.lock, pnpm-lock.yaml, and any vendored bundles or container images. Because exploitation requires a prototype-pollution primitive, also remediate prototype-pollution vulnerabilities across the dependency tree and reject unsafe object keys such as __proto__, constructor, and prototype in untrusted input handling. Where immediate upgrade is not possible, reduce exposure by allowlisting outbound header names, preventing user-controlled values from influencing service-to-service headers, blocking unexpected headers at egress proxies or receiving services, and monitoring for polluted Object.prototype state. Do not treat these mitigations as equivalent to upgrading Axios.

How to confirm the fix worked

Confirm that every installed and packaged Axios instance resolves to 1.15.1 or later, or 0.31.1 or later for maintained 0.x usage. Use package-manager inventory commands such as npm ls axios, yarn why axios, pnpm why axios, software composition analysis, and lockfile review to identify duplicate or transitive vulnerable copies. Validate built artifacts and container images, not only source repositories. In a non-production test environment, add a regression test that simulates the relevant polluted prototype properties and verifies that Axios no longer merges attacker-controlled headers into outbound requests. Also verify that egress gateways, API clients, and downstream services reject or ignore unexpected security-sensitive headers.

Typical attack path

1. Identify a Node.js application that uses Axios before 1.15.1 or 0.31.1 for outbound HTTP requests.
2. Find or exploit a separate prototype-pollution source in the application or one of its dependencies.
3. Pollute Object.prototype with FormData-like properties required to trigger Axios’ HTTP adapter detection path, including an attacker-controlled getHeaders function.
4. Cause the application to make an Axios request with a plain object payload.
5. Have vulnerable Axios misidentify the payload as FormData and merge attacker-controlled headers into the outbound request.
6. Use the injected headers to influence authentication, authorization, routing, request context, proxy behavior, or downstream business logic.

How to detect it

Historical exploitation is difficult to prove from application logs alone because successful exploitation may only appear as abnormal outbound HTTP headers and the required prototype pollution may occur in a different dependency. Review egress proxy logs, service mesh telemetry, API gateway logs, downstream service access logs, WAF logs, and application HTTP client debug logs for unexpected headers on requests originating from Node.js services that used vulnerable Axios versions. Focus on headers that should never be set by the application or that can alter identity, routing, method semantics, tenant context, or proxy behavior, such as Authorization, Cookie, Host, X-Forwarded-For, X-Forwarded-Host, X-Original-URL, X-Rewrite-URL, X-HTTP-Method-Override, X-Api-Key, and custom role or tenant headers. Correlate suspicious outbound headers with inbound requests containing prototype-pollution keys or JSON parameters such as __proto__, constructor, prototype, getHeaders, append, pipe, on, once, or Symbol.toStringTag. In forensic reviews, inspect runtime diagnostics, heap snapshots, crash dumps, and application instrumentation for unexpected properties on Object.prototype. Also review dependency vulnerability findings for known prototype-pollution sources in the same application, because this Axios issue is a gadget rather than the pollution source itself.

• __proto__
• constructor.prototype
• prototype.getHeaders
• Object.prototype.getHeaders
• Object.prototype.append
• Object.prototype.pipe
• Object.prototype.on
• Object.prototype.once
• Symbol.toStringTag
• getHeaders
• X-HTTP-Method-Override
• X-Forwarded-Host
• X-Original-URL
• X-Rewrite-URL
• lib/adapters/http.js

What your security team should do

• Prioritize upgrading Axios to 1.15.1 or later, or 0.31.1 or later for 0.x deployments, across all Node.js services and build artifacts.
• Inventory direct and transitive Axios usage with SCA tooling and package-manager lockfile analysis; do not rely only on top-level package.json entries.
• Search for and remediate prototype-pollution vulnerabilities in the same applications, because this Axios issue is triggered by pollution originating elsewhere.
• Review services that use Axios for privileged service-to-service calls, internal API access, identity flows, payment flows, administrative actions, or data export paths first.
• Add allowlists or validation for outbound headers sent by server-side HTTP clients, especially Authorization, Cookie, Host, X-Forwarded-*, X-HTTP-Method-Override, X-Api-Key, and tenant or role context headers.
• Add detection for unexpected outbound headers from Node.js services at proxies, API gateways, service meshes, and receiving services.
• Create regression tests to ensure polluted prototypes cannot alter Axios request headers after remediation.