CVE-2026-42033 (High) detected in axios-0.19.0.tgz

[mend-bolt-for-github]

CVE-2026-42033 - High Severity Vulnerability

Vulnerable Library - axios-0.19.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.0.tgz

Path to dependency file: /day59/package.json

Path to vulnerable library: /day59/package.json,/day60/package.json

Dependency Hierarchy:

• browser-sync-2.26.13.tgz (Root Library)
  • localtunnel-2.0.0.tgz
    • ❌ axios-0.19.0.tgz (Vulnerable Library)

Found in HEAD commit: c88b9429eb68a85b22f0e39cac7bf20b89cb6709

Found in base branch: master

Vulnerability Details

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.

Publish Date: 2026-04-24

URL: CVE-2026-42033

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pf86-5x62-jrwf

Release Date: 2026-04-24

Fix Resolution (axios): 1.15.1

Direct dependency fix Resolution (browser-sync): 3.0.0

---

Step up your Open Source Security Game with Mend here