THREAT OPS › Threat News › [NVD] CVE-2026-42033 (HIGH 7.4) — Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON respo
[NVD] CVE-2026-42033 (HIGH 7.4) — Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON respo
CVE-2026-42033 CVSS: 7.4 HIGH Published: 2026-04-24T18:16:29.993
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijac
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-42033cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42033