CVE-2026-42042 Details
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.
A vulnerability in the Axios library, affecting versions prior to 1.15.1 and 0.31.1, allows for cross-origin leakage of XSRF tokens due to improper boolean handling in the 'withXSRFToken' configuration property. This issue arises when 'withXSRFToken' is set to a truthy non-boolean value, either through prototype pollution or misconfiguration. The flaw bypasses the same-origin check, causing XSRF tokens to be sent to all request targets, including attacker-controlled cross-origin servers. This vulnerability is present in the browser environment, where the XSRF protection logic is active.
Users can upgrade to Axios versions 1.15.1 or 0.31.1, where this vulnerability has been fixed. The recommended fix involves changing the XSRF token handling logic to use strict boolean comparisons, ensuring that only the correct values are interpreted as truthy.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-183 | Permissive List of Allowed Inputs | [email protected] |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | < 0.31.1 >= 1.0.0, < 1.15.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |