Axios versions prior to 1.15.1 and 0.31.1 contain a low-severity vulnerability (CVE-2026-42040) in the AxiosURLSearchParams helper module. The internal encode function incorrectly reverses the percent-encoding of null bytes, converting the safe '%00' sequence back into a raw null byte. This defect can lead to null byte injection when using AxiosURLSearchParams directly without an external encoder, potentially causing issues such as URL truncation in downstream C-based parsers. The standard axios request flow using buildURL is not affected. A fix is available in versions 1.15.1 and 0.31.1.