Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Description

No description available.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 0.31.0

  >= 1.0.0, < 1.15.1**

• Patched version(s): **0.31.1

  1.15.1**

References

• GHSA-xhjh-pmcv-23jw
• CVE-2026-42040
• CWE-116
• CWE-626
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
• Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - CVE-2026-44496
• Axios: Header Injection via Prototype Pollution - CVE-2026-42035
• Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - CVE-2026-40175

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

axios