CVE-2026-42040

What it actually does

The vulnerability exists in the `AxiosURLSearchParams` helper function, which improperly handles null bytes. The function's character map reverses the safe percent-encoding of a null byte (`\x00`) from `%00` back into a raw null byte. This allows for the injection of null bytes into URL query parameters when this specific, non-standard helper is used. This can lead to request smuggling, log evasion, or bypassing security filters on backend systems that are not robust against null byte injection, such as those that treat a null byte as a string terminator.

Why it matters to the business

The business impact is low. Exploitation could allow an attacker to bypass certain security controls or cause unexpected application behavior by manipulating data sent to backend services. This might lead to minor data integrity issues or circumvention of logging mechanisms. However, the vulnerability is difficult to exploit as it requires a specific, non-standard use of the Axios library, making the real-world risk minimal for most organizations.

How an attack unfolds

An attacker identifies a web application that uses a vulnerable version of the Axios library and specifically utilizes the `AxiosURLSearchParams` helper to construct URLs from user-supplied input. The attacker provides input containing a null byte. The vulnerable library code first correctly encodes the null byte to `%00` but then incorrectly decodes it back to a raw `\x00` due to a flawed character map. This malformed URL is then used in an HTTP request to a backend server. If the server or any intermediate proxy (like a WAF) interprets the null byte as a terminator, the attacker may successfully truncate the URL, bypassing parameter-based security checks or manipulating the server's logic.

How to fix it

Upgrade the Axios library to a patched version. The vulnerability is fixed in versions 1.15.1 and 0.31.1. Update your project's dependencies in `package.json` to specify a fixed version (e.g., `"axios": "^1.15.1"`) and run `npm install` or `yarn` to apply the update. Verify that the lock files (`package-lock.json` or `yarn.lock`) reflect the updated version.

How to confirm the fix worked

Use a Software Composition Analysis (SCA) tool or manually inspect project lock files (`package-lock.json`, `yarn.lock`) to confirm that all instances of the `axios` package are at version 1.15.1, 0.31.1, or higher. To test for exposure, create a unit test that uses `AxiosURLSearchParams` with a string containing a null byte and assert that the resulting URL string contains `%00` and not a raw null byte.

Typical attack path

1. Attacker identifies a target application using a vulnerable version of Axios.
2. Attacker discovers an input field that is processed by the `AxiosURLSearchParams` helper function.
3. Attacker submits a payload containing a null byte (`\x00`).
4. The vulnerable Axios code incorrectly processes the input, embedding a raw null byte into the URL parameters of an outgoing client-side request.
5. The backend server receives the malformed request.
6. The backend server or a security appliance misinterprets the request due to the null byte, leading to a bypass of security controls or other unexpected behavior.

How to detect it

Detection of exploitation attempts involves monitoring server-side logs for anomalous requests. Check web server access logs (e.g., Nginx, Apache, IIS) and application-level logs for the presence of raw, unencoded null bytes (`\x00`) within URL query string parameters. The presence of a null byte in a URL is highly irregular and a strong indicator of a null byte injection attempt, which could be related to this or other similar vulnerabilities.

What your security team should do

• Use a Software Composition Analysis (SCA) tool to identify all projects using vulnerable versions of Axios.
• Given the low severity (CVSS 3.7) and high attack complexity, treat this as a low-priority vulnerability and schedule it for remediation during the next regular patch cycle.
• Encourage development teams to avoid direct use of the `AxiosURLSearchParams` helper where possible, as the standard Axios request flow is not affected.