CVE-2026-42042
Fixed in a distro release EPSS <1%CVSS 5.4
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.15.1 |
| npm | axios | 0.31.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | arangodb-3.11 | 3.11.14.5-r14 |
| Chainguard | awx | 24.6.1-r42 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r7 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.3-r7 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.4-r4 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r4 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.7-r1 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r22 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kibana-7 | no fix |
| Chainguard | kibana-8.17 | 8.17.10-r21 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r21 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r21 |
| Chainguard | kibana-8.19 | 8.19.15-r0 |
| Chainguard | kibana-8.19-bitnami | 8.19.15-r0 |
| Chainguard | kibana-8.19-iamguarded | 8.19.15-r0 |
| Chainguard | kibana-9.0 | 9.0.8-r24 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r24 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r24 |
| Chainguard | kibana-9.1 | 9.1.10-r16 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r16 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r0 |
| Chainguard | kibana-9.3 | 9.3.4-r4 |
| Chainguard | kibana-9.3-iamguarded | 9.3.4-r4 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r21 |
| Chainguard | langfuse-2 | 2.95.12-r23 |
| Chainguard | langfuse-2-worker | 2.95.12-r23 |
| Chainguard | langfuse-3 | 3.174.1-r0 |
| Chainguard | langfuse-3-worker | 3.174.1-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r25 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r25 |
| Chainguard | langfuse-fips-3 | 3.174.1-r0 |
| Chainguard | langfuse-fips-3-worker | 3.174.1-r0 |
| Chainguard | langfuse-fips-3.152-worker | 3.152.0-r1 |
| Chainguard | lerna | 9.0.7-r4 |
| Chainguard | nextcloud-server-31 | 31.0.14-r5 |
| Chainguard | nextcloud-server-33 | 33.0.6-r0 |
| Chainguard | nextcloud-server-34 | 34.0.1-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.5-r10 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r10 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r9 |
| Chainguard | opensearch-dashboards-3 | 3.6.0-r3 |
| Chainguard | opensearch-dashboards-3-fips | 3.6.0-r5 |
| Chainguard | prism | 5.15.10-r0 |
| Chainguard | redisinsight | 3.4.2-r1 |
| Chainguard | saf | 1.6.0-r0 |
| Chainguard | wazuh-dashboard | 4.14.5-r5 |
| Chainguard | wazuh-dashboard-fips | 4.14.5-r5 |
| Chainguard | wazuh-dashboard-plugins | 4.14.4-r3 |
| Debian 12 | node-axios | no fix |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.15.2-1 |
| Ubuntu 25.10 | node-axios | no fix |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r22 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r21 |
| Wolfi | langfuse-3 | 3.174.1-r0 |
| Wolfi | langfuse-3-worker | 3.174.1-r0 |
| Wolfi | lerna | 9.0.7-r4 |
| Wolfi | nextcloud-server-33 | 33.0.6-r0 |
| Wolfi | opensearch-dashboards-3 | 3.6.0-r3 |
| Wolfi | prism | 5.15.10-r0 |
| Wolfi | saf | 1.6.0-r0 |