CVE-2026-42040 Details
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.
A null byte injection vulnerability has been identified in Axios versions prior to 1.15.1 and 0.31.1. The issue arises in the encode() function within 'lib/helpers/AxiosURLSearchParams.js', where a character mapping reverses the safe percent-encoding of null bytes. This flaw allows the charMap entry '%00' to convert the encoded null byte back to its raw form, creating a potential issue when the URL is processed by a vulnerable downstream parser. While the vulnerability is not present in the standard Axios request flow, it can be exploited by direct API users or through custom 'paramsSerializer' delegation.
Users should update to Axios versions 1.15.1 or 0.31.1 and remove the '%00' entry from the character mapping in the 'encode()' function.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | < 0.31.1 >= 1.0.0, < 1.15.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |