DEBIAN-CVE-2026-42033
Record from OSV · Published April 24, 2026
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| node-axios | Debian:14 | 1.15.2-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | node-axios | 1.8.4+dfsg-1, 1.11.0+dfsg-1, 1.12.1+dfsg-1 |
| Debian:13 | node-axios | 1.15.0-1, 1.15.2-1, 1.16.0-1 |
| Debian:14 | node-axios | 0, 1.12.1+dfsg-1, 1.13.1+dfsg-1 |
Timeline
- Apr 24, 2026 CVE Published
- Oct 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2026-42033
vulnetix vdb fixes DEBIAN-CVE-2026-42033Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2026-42033/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart