Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Summary
| CVE | CVE-2026-42044 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-24 18:16:31 UTC |
| Updated | 2026-07-21 12:18:33 UTC |
| Description | Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact. This vulnerability is fixed in 1.15.2. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.005860000 probability, percentile 0.442210000 (date 2026-07-21)
Problem Types: CWE-915 | CWE-1321 | CWE-915 CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes | CWE-1321 CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | ADP | CVSS | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | [email protected] | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | CNA | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Axios | Axios | affected >= 1.0.0, < 1.15.2 | Not specified |
| ADP | Red Hat | HawtIO HawtIO 4.4.0 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:2.5.20260715-1.el8ap * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:2.5.20260715-1.el9ap * rpm | Not specified |
| ADP | Red Hat | Streams For Apache Kafka 2.9.4 | Not specified | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.1 | unaffected 1780917531 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.11.0 | unaffected 1780910888 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.6 | unaffected 1778511348 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.8 | unaffected 1778383863 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.9 | unaffected 1778532610 * rpm | Not specified |
| ADP | Red Hat | Network Observability NETOBSERV 1.12.0 | unaffected 1780920979 * rpm | Not specified |
| ADP | Red Hat | Network Observability NETOBSERV 1.12.0 | unaffected 1780556069 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.14 | unaffected 1783451729 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.15 | unaffected 1780876734 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1780600823 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security 4.9 | unaffected 1779371594 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Security For Kubernetes 4.10 | unaffected 1779293013 * rpm | Not specified |
| ADP | Red Hat | Red Hat Container Native Virtualization 4.15 | unaffected 1782917983 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.8 | unaffected 1779841586 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1781187342 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1782761244 * rpm | Not specified |
| ADP | Red Hat | Red Hat Discovery 2 | unaffected 1779395188 * rpm | Not specified |
| ADP | Red Hat | Red Hat Migration Toolkit 1.8 | unaffected 1780590717 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.28 | unaffected 1779814592 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.28 | unaffected 1779341289 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 2.6 | unaffected 1779520355 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 2.6 | unaffected 1779520348 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.0 | unaffected 1778163785 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.0 | unaffected 1778164208 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.1 | unaffected 1778163935 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.1 | unaffected 1778164042 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.2 | unaffected 1778163792 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.2 | unaffected 1778163909 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.3 | unaffected 1778163785 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Service Mesh 3.3 | unaffected 1778163986 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.1 | unaffected 1779822261 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.12 | unaffected 1779811412 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.14 | unaffected 1779689392 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.15 | unaffected 1780891395 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.16 | unaffected 1779204086 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.16 | unaffected 1783955846 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.17 | unaffected 1779922205 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.9 | unaffected 1779811473 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1781181673 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1781032495 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1780105179 * rpm | Not specified |
| ADP | Red Hat | Red Hat Trusted Artifact Signer 1.3 | unaffected 1779971506 * rpm | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Gatekeeper 3 | Not specified | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Migration Toolkit For Applications 8 | Not specified | Not specified |
| ADP | Red Hat | Network Observability Operator | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | OpenShift Service Mesh 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat 3scale API Management Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Podman Desktop - Tech Preview | Not specified | Not specified |
| ADP | Red Hat | Red Hat Data Grid 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Developer Hub | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Fuse 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Process Automation 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Trusted Profile Analyzer | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
| ADP | Red Hat | Streams For Apache Kafka 3 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:16535 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20889 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20454 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | Exploit, Mitigation, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:24853 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20338 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24471 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36882 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22629 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:16542 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:21017 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24473 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26232 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:16532 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25089 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20938 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:21338 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26214 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26225 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:19375 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42044.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:34608 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25273 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22465 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:42078 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:19109 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17699 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:23361 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:21772 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:16534 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24536 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:36107 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:24539 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41066 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25271 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:22840 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:17657 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:26234 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-42044 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25041 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:33574 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-04-24T19:01:13.418Z | Reported to Red Hat. |
| ADP | 2026-04-24T17:49:49.517Z | Made public. |
Solutions
ADP: RHSA-2026:42078: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9
ADP: RHSA-2026:25089: HawtIO HawtIO 4.4.0
ADP: RHSA-2026:24473: Network Observability (NETOBSERV) 1.12.0
ADP: RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14
ADP: RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15
ADP: RHSA-2026:25273: Red Hat Advanced Cluster Management for Kubernetes 2.16
ADP: RHSA-2026:20938: Red Hat Advanced Cluster Security 4.9
ADP: RHSA-2026:20889: Red Hat Advanced Cluster Security for Kubernetes 4.10
ADP: RHSA-2026:36107: Red Hat Container Native Virtualization 4.15
ADP: RHSA-2026:21338: Red Hat Developer Hub 1.8
ADP: RHSA-2026:33574: Red Hat Developer Hub 1.9
ADP: RHSA-2026:26234: Red Hat Developer Hub 1.9
ADP: RHSA-2026:20338: Red Hat Discovery 2
ADP: RHSA-2026:25041: Red Hat Migration Toolkit 1.8
ADP: RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28
ADP: RHSA-2026:20454: Red Hat OpenShift Service Mesh 2.6
ADP: RHSA-2026:16534: Red Hat OpenShift Service Mesh 3.0
ADP: RHSA-2026:16532: Red Hat OpenShift Service Mesh 3.1
ADP: RHSA-2026:16535: Red Hat OpenShift Service Mesh 3.2
ADP: RHSA-2026:16542: Red Hat OpenShift Service Mesh 3.3
ADP: RHSA-2026:22629: Red Hat Quay 3.12
ADP: RHSA-2026:21017: Red Hat Quay 3.14
ADP: RHSA-2026:24853: Red Hat Quay 3.15
ADP: RHSA-2026:19375: Red Hat Quay 3.16
ADP: RHSA-2026:41066: Red Hat Quay 3.16
ADP: RHSA-2026:22465: Red Hat Quay 3.17
ADP: RHSA-2026:22840: Red Hat Quay 3.1
ADP: RHSA-2026:23361: Red Hat Quay 3.9
ADP: RHSA-2026:26214: Red Hat Satellite 6.18
ADP: RHSA-2026:26232: Red Hat Satellite 6.18
ADP: RHSA-2026:26225: Red Hat Satellite 6.18
ADP: RHSA-2026:24471: Red Hat Trusted Artifact Signer 1.3
ADP: RHSA-2026:34608: Streams for Apache Kafka 2.9.4
ADP: RHSA-2026:25271: multicluster engine for Kubernetes 2.11.0
ADP: RHSA-2026:24536: multicluster engine for Kubernetes 2.1
ADP: RHSA-2026:17657: multicluster engine for Kubernetes 2.6
ADP: RHSA-2026:17699: multicluster engine for Kubernetes 2.8
ADP: RHSA-2026:19109: multicluster engine for Kubernetes 2.9
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
There are currently no legacy QID mappings associated with this CVE.