Search: CVE-2026-42044

Axios versions from 1.0.0 up to but not including 1.15.2 are vulnerable to a prototype pollution attack that allows attackers to modify JSON API responses invisibly. This can lead to privilege escalation, balance manipulation, and authorization bypass. The vulnerability arises because the default JSON response transformation calls a parseReviver function that can be polluted via Object.prototype, enabling selective modification of response values. The issue is fixed in version 1.15.2.