Low severity3.7NVD Advisory· Published Apr 24, 2026· Updated Apr 27, 2026
CVE-2026-42040
CVE-2026-42040
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
axiosnpm | >= 1.0.0, < 1.15.1 | 1.15.1 |
axiosnpm | < 0.31.1 | 0.31.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jwnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-xhjh-pmcv-23jwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42040ghsaADVISORY
News mentions
0No linked articles in our index yet.