Axios Patches Multiple Prototype Pollution and SSRF Flaws in Node.js HTTP Adapter

Axios patched several high-severity vulnerabilities affecting its Node.js HTTP adapter, including CVE-2026-40175, a critical flaw in versions below 1.13.2 that Singapore's CSA said could enable unauthenticated SSRF, potential remote code execution, and full cloud compromise. Separate disclosures also detailed CVE-2026-42264, which affects Axios 1.0.0 through 1.15.1 and allows attacker-controlled values inherited from a polluted Object.prototype to alter request behavior, enabling credential injection, request redirection, SSRF to Unix sockets, arbitrary code execution during redirects, and weaker HTTP parsing. Axios fixed that issue in 1.15.2 after merging hardening changes into the main branch.

A later advisory described CVE-2026-44494, another prototype-pollution gadget in Axios's handling of config.proxy that affects versions from 1.0.0 up to but not including 1.16.0, with the 0.x branch also tracked as affected below 0.32.0. If an application already contains a separate prototype-pollution source, the flaw can silently route outbound Axios traffic through an attacker-controlled proxy, exposing Authorization headers, cookies, and request bodies while allowing forged responses and full man-in-the-middle interception. Axios addressed the issue in 1.16.0, and a backport commit for the 0.x line added null-prototype object merging and other hardening measures to reduce prototype-pollution risk.