Axios CVE-2026-42035: Prototype Pollution Leads to Header Injection

The National Vulnerability Database has disclosed CVE-2026-42035, a high-severity prototype pollution vulnerability in Axios, a widely used HTTP client for browsers and Node.js. This flaw, present in versions prior to 1.15.1 and 0.31.1, specifically targets the HTTP adapter (lib/adapters/http.js) and allows attackers to inject arbitrary HTTP headers into outgoing requests. The vulnerability is rated 7.4 (HIGH) on the CVSS scale.

The attack vector leverages Axios’s duck-type checking of data payloads. An attacker can pollute Object.prototype with specific functions (getHeaders, append, pipe, on, once, Symbol.toStringTag), causing Axios to misinterpret a plain object as a FormData instance. This then triggers a call to an attacker-controlled getHeaders() function, merging malicious headers into the outgoing request. Critically, the prototype pollution source doesn’t need to originate from Axios itself; any vulnerable dependency in the application’s tree is sufficient to trigger this gadget.

This vulnerability highlights the insidious nature of prototype pollution, which often flies under the radar until it’s chained with other application logic. For defenders, this isn’t just about Axios; it’s a reminder that a single, seemingly minor prototype pollution primitive anywhere in a complex dependency graph can have significant downstream consequences. The National Vulnerability Database reports this issue is fixed in Axios versions 1.15.1 and 0.31.1.