7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42264

CVE-2026-42264: Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42264

CVE-2026-42264:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
axios	npm	>= 1.0.0, < 1.15.2	1.15.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of prototype pollution in JavaScript. The axios library did not properly check for own properties when accessing configuration options. This allowed an attacker who could pollute Object.prototype in the same process to inject malicious configuration into every axios request.

The core of the vulnerability lies in several key functions:

mergeConfig: This function was responsible for merging default and user-provided configurations. It created a standard object {} which inherits from Object.prototype. This was the entry point for the polluted properties to enter the configuration.
resolveConfig: This function resolved the final URL for the request. It read baseURL from the configuration without an own property check, allowing an attacker to hijack requests with relative URLs.
httpAdapter: This is the main function for making HTTP requests in Node.js. It read several sensitive configuration options like auth, socketPath, beforeRedirect, and insecureHTTPParser directly from the configuration object. This allowed for a range of attacks, including credential injection, Server-Side Request Forgery (SSRF) via socketPath, remote code execution via beforeRedirect, and weakening of the HTTP parser.
assertOptions: This validation function was also vulnerable, as it accessed schema properties without checking for own properties, potentially leading to a denial of service.

The patch addresses these issues by:

Modifying mergeConfig to create a null-prototype object using Object.create(null). This is the most critical fix as it prevents the merged configuration from inheriting any properties from Object.prototype.
Adding hasOwnProperty checks (via an own() helper) in httpAdapter and resolveConfig before accessing sensitive configuration properties. This provides defense-in-depth.
Using Object.prototype.hasOwnProperty.call() in assertOptions to safely access schema properties.

By identifying these functions, a security engineer can understand the runtime behavior of the exploit and create targeted monitoring and detection rules.

Vulnerable functions

httpAdapter

lib/adapters/http.js

The main exported function in `lib/adapters/http.js` (aliased as `httpAdapter` for clarity) was vulnerable to prototype pollution. It directly accessed `config.auth`, `config.socketPath`, `config.beforeRedirect`, and `config.insecureHTTPParser` without `hasOwnProperty` checks. This allowed an attacker to inject malicious values for these properties by polluting `Object.prototype`, leading to credential injection, request hijacking (SSRF), remote code execution, and parser weakening.

resolveConfig

lib/helpers/resolveConfig.js

The `resolveConfig` function was vulnerable to prototype pollution. It accessed `newConfig.baseURL` and other properties directly without checking if they were own properties. An attacker could pollute `Object.prototype.baseURL` to hijack all requests made with relative URLs.

mergeConfig

lib/core/mergeConfig.js

The `mergeConfig` function was a source of the prototype pollution vulnerability. It created a new configuration object with `{}`. This meant that the resulting object inherited from `Object.prototype`. If `Object.prototype` was polluted, the merged configuration would contain the polluted properties. The fix was to create a null-prototype object using `Object.create(null)`, which does not inherit from `Object.prototype`.

assertOptions

lib/helpers/validator.js

The `assertOptions` function was vulnerable because it accessed `schema[opt]` directly. If an attacker could pollute `Object.prototype` with a property that matched one of the options, and the value of that property was not a function, it would cause a `TypeError`, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.