Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-42042 · CVE overview and exploitation status

EUVD-2026-25607

GHSA-xx6v-rp6x-q39c

cve-program · CVE-2026-42042

• https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c

euvd · EUVD-2026-25607

• https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c

nvd · CVE-2026-42042

• https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c

osv · GHSA-xx6v-rp6x-q39c

• https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c
• https://nvd.nist.gov/vuln/detail/CVE-2026-42042
• https://github.com/axios/axios

• Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken … · Advisory content revised · 15 Nov 2026