CVE-2026-42042

What it actually does

A flaw in the Axios library's Cross-Site Request Forgery (XSRF) protection logic allows for a bypass of same-origin checks. The `withXSRFToken` configuration property incorrectly evaluates non-boolean 'truthy' values, causing the library to attach the sensitive XSRF token to HTTP requests sent to any origin. This allows an attacker-controlled server to receive the XSRF token, compromising the integrity of the anti-CSRF mechanism.

Why it matters to the business

If an application uses a vulnerable version of Axios, users can be tricked into leaking their anti-CSRF token to a malicious website. An attacker can then use this stolen token to perform unauthorized actions on behalf of the user, such as modifying account data, making fraudulent transactions, or accessing sensitive information. This can lead to user account takeovers, financial loss, and reputational damage.

How an attack unfolds

An attacker first identifies a web application using a vulnerable version of Axios. They then find a way to set the `withXSRFToken` configuration to a truthy, non-boolean value, often through a separate prototype pollution vulnerability or an application misconfiguration. The attacker then crafts a malicious webpage and tricks an authenticated user into visiting it. This page triggers a cross-origin request to an attacker-controlled server using the application's vulnerable Axios instance. Due to the flaw, Axios attaches the user's XSRF token to this request. The attacker's server captures the token and subsequently uses it to forge malicious requests to the legitimate application, bypassing its CSRF protections.

How to fix it

Upgrade the Axios library to a patched version. For projects on the 1.x branch, update to version 1.15.1 or newer. For projects on the 0.x branch, update to version 0.31.1 or newer. If an immediate upgrade is not feasible, audit code to ensure the `withXSRFToken` configuration property is only ever assigned a strict boolean value and cannot be influenced by untrusted data.

How to confirm the fix worked

To confirm remediation, inspect your project's dependency manifest (e.g., `package-lock.json`, `yarn.lock`) to ensure the resolved version of Axios is 1.15.1+ or 0.31.1+. To test for exposure, you can manually configure a vulnerable Axios instance with a truthy, non-boolean value for `withXSRFToken` (e.g., `axios.defaults.withXSRFToken = {}`) and observe network traffic. In a vulnerable version, a cross-origin request will incorrectly include the XSRF token header (e.g., `X-XSRF-TOKEN`); in a patched version, it will not.

Typical attack path

1. An attacker identifies a target application using a vulnerable version of the Axios library.
2. The attacker finds a method to set the `withXSRFToken` config property to a truthy, non-boolean value, such as through prototype pollution.
3. The attacker lures an authenticated user of the target application to a malicious website.
4. The malicious site causes the user's browser to make a cross-origin request to an attacker-controlled server using the vulnerable Axios instance.
5. The vulnerable library incorrectly attaches the application's XSRF token to the request, leaking it to the attacker.
6. The attacker uses the stolen token to perform unauthorized, forged requests against the target application on behalf of the user.

How to detect it

Detecting exploitation is challenging as it originates on the client side. Server-side detection should focus on behavioral anomalies, such as a valid session and XSRF token being used from an IP address or geography inconsistent with the user's established patterns. The most direct evidence would be found in client-side network logs or proxy logs showing an outbound request to an untrusted, third-party domain that contains the application's specific XSRF header (e.g., `X-XSRF-TOKEN`). This indicates the token has been leaked.

What your security team should do

• Immediately prioritize upgrading all instances of the Axios library to a patched version (1.15.1+ or 0.31.1+).
• Utilize Software Composition Analysis (SCA) tools to discover all direct and transitive dependencies on vulnerable Axios versions across your organization's software portfolio.
• Audit applications for prototype pollution vulnerabilities, as they are a primary vector for exploiting this flaw.
• Review Axios configurations to ensure the `withXSRFToken` property is explicitly and securely handled, using only boolean values.