Read the docs
TI-2026-30578 Aliases CVE-2026-42264GHSA-q8qp-cvcw-x6jj

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Priority HIGH 74CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 15 fixed, 15 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00797 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.15.2axios (npm): 1.15.2Red Hat: 16 advisoriesRed Hat: 15 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.0.0 to before 1.15.21.15.2Patch availableCNA
—axios (npm)1.0.0 to before 1.15.21.15.2Patch availableGHSA-q8qp-cvcw-x6jj
  • axios Vendoraxios Affected 1.0.0 to before 1.15.2 Fixed in 1.15.2 Patch available CNA
  • axios (npm) Vendor— Affected 1.0.0 to before 1.15.2 Fixed in 1.15.2 Patch available GHSA-q8qp-cvcw-x6jj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*1.0.0 to before 1.15.2Vulnerableaxios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions 1.0.0 to before 1.15.2 Vulnerable ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.15.2
  • Fix · GHSA-q8qp-cvcw-x6jj axios (npm) Fixed in 1.15.2 Advisory →

Red Hat 16 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
Show 13 more Red Hat advisories
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:42142 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
  • RHSA-2026:41951 Released 2026-07-20 · Red Hat rating Important
    Red Hat Data Grid 8.6.2 security update
    • Red Hat Data Grid 8.6.2
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:37297 Released 2026-07-09 · Red Hat rating Important
    Kiali 2.11.14 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:37288 Released 2026-07-09 · Red Hat rating Important
    Kiali 2.22.7 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:37287 Released 2026-07-09 · Red Hat rating Important
    Kiali 2.4.20 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:36207 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.11.1 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator +4
  • RHSA-2026:33173 Released 2026-06-29 · Red Hat rating Important
    Kiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:20938 Released 2026-05-26 · Red Hat rating Important
    RHACS 4.9.7 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2026:20889 Released 2026-05-26 · Red Hat rating Important
    RHACS 4.10.3 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
streams for Apache Kafka 2AffectedNo fix yet
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:20938
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:36207
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:20889
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:42142
Red Hat Data Grid 8.6.2Fixed RHSA-2026:41951
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:37287
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:37297
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:33173
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:37288
Not affected: 31 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Applications 8
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • OpenShift Pipelines
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Profile Analyzer
  • Red Hat build of Apache Camel for Spring Boot 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42264
  2. 2026-10-03 Alias added: GHSA-q8qp-cvcw-x6jj
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-10-30 Affected versions changed · Red Hat
  8. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  9. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
  • TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
  • TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
  • TI-2026-32424 Axios: Allocation of Resources Without Limits or Throttling in axios CVSS 3.1HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences