GHSA-6chq-wfr3-2hj9 · Severity: high · Ecosystem: npm — Axios: Header Injection via Prototype Pollution
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
Conclusion & alert: CVE-2026-42035 is rated Exploit Available (50/100): CVSS High severity, with low exploitation likelihood (EPSS 0.03%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-22 | 0.06% | 0.03% | -0.03% |
| 2 | 2026-04-28 | 0.03% | 0.06% | +0.03% |
| 3 | 2026-04-25 | — | 0.03% | — |
Full EPSS history (3 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.4 | 3.1 | HIGH |
|
2.2 | 5.2 | [email protected] |
GHSA-6chq-wfr3-2hj9 · Severity: high · Ecosystem: npm — Axios: Header Injection via Prototype Pollution
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-42035 not yet assigned priority: Debian including 1 source packages (node-axios), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2026-42035 |
ubuntu
|
medium | CVE-2026-42035 medium priority: Ubuntu including 1 source packages (node-axios), 6 status rows across 6 suites (focal, jammy, noble, questing, resolute, upstream): needs-triage 5, released 1. | https://ubuntu.com/security/CVE-2026-42035 |
| URL | Tags |
|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9 | Exploit Mitigation Vendor Advisory |