Axios, a promise-based HTTP client for Node.js and browsers, versions 1.0.0 through before 1.15.2 are affected by a prototype pollution vulnerability (CVE-2026-42044). The vulnerability occurs because the default transformResponse function invokes JSON.parse with a parseReviver function that is not validated or constrained. An attacker who can pollute Object.prototype with a parseReviver function can manipulate individual key-value pairs in JSON responses, enabling stealthy modifications such as privilege escalation and authorization bypass. This vulnerability is resolved in Axios version 1.15.2.

Successful exploitation allows attackers to invisibly modify JSON API responses, potentially leading to privilege escalation, manipulation of sensitive data such as balances, and bypass of authorization controls. This can compromise application integrity and security without obvious signs in the response data.

A fix is available in Axios version 1.15.2. Users should upgrade to version 1.15.2 or later to remediate this vulnerability. For Ubuntu users, security updates are available via Ubuntu Pro Extended Security Maintenance (ESM) for supported LTS releases. Applying the official patches or updates from the vendor is the recommended remediation.