Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34160 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-platform-ui: Axios: Denial of Service due to unenforced request and response size limits     (CVE-2026-44488)
    * automation-platform-ui: Axios: Information disclosure due to prototype pollution vulnerability     (CVE-2026-44495)
    * automation-platform-ui: fast-uri: URI authority bypass due to improper delimiter handling     (CVE-2026-6322)
    * automation-platform-ui: Axios: Arbitrary HTTP header injection via prototype pollution (CVE-2026-42035)
    * automation-platform-ui: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization     (CVE-2026-41240)
    * automation-platform-ui: protobufjs: Arbitrary code execution due to unsafe expression generation from     crafted protobuf descriptors (CVE-2026-44293)
    * python3.12-pyjwt: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)
    * automation-controller: Dynaconf: Arbitrary code execution via Server-Side Template Injection     (CVE-2026-33154)
    * python3.12-urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers     (CVE-2026-44431)
    * python3.12-urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0295 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-42037:
    Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the     FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the     Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who     controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy     service) can inject arbitrary MIME part headers into the multipart form-data body. This bypasses Node.js     v18+ built-in header protections because the injection targets the multipart body structure, not HTTP     request headers. This vulnerability is fixed in 1.15.1.

    CVE-2026-42035:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype     pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject     arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data     payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and     Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the     attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The     vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need     to originate from Axios itself  any prototype pollution primitive in any dependency in the     application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1     and 0.31.1.

    CVE-2026-42033:
    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when     Object.prototype has been polluted by any co-dependency with keys that axios reads without a     hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the     application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request     credentials, headers, and body. The precondition is prototype pollution from a separate source in the same     process. This vulnerability is fixed in 1.15.1 and 0.31.1.

    CVE-2026-41242:
    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and     7.5.5, attackers can inject arbitrary code in the type fields of protobuf definitions, which will then     execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

    CVE-2026-33896:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints     requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions.
    This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates,     which node-forge will accept as valid. Version 1.4.0 patches the issue.

    CVE-2026-33895:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the     scalar S is not reduced modulo the group order (`S >= L`). A valid signature and its `S + L` variant both     verify in forge, while Node.js `crypto.verify` (OpenSSL-backed) rejects the `S + L` variant, as defined by     the specification. This class of signature malleability has been exploited in practice to bypass     authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on     signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization     checks) may be bypassed. Version 1.4.0 patches the issue.

    CVE-2026-33894:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public     exponent keys (e=3). Attackers can forge signatures by stuffing garbage bytes within the ASN     structure in order to construct a signature that passes verification, enabling Bleichenbacher style     forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN     structure, rather than outside of it.  Additionally, forge does not validate that signatures include a     minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to     construct Bleichenbacher forgeries. Version 1.4.0 patches the issue.

    CVE-2026-33891:
    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
    Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an     infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When     modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an     unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0     patches the issue.

    CVE-2026-33228:
    flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use     attacker-controlled string values from the parsed JSON as direct array index keys, without validating that     they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key
    __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate     parsed value and assigned as a property of the output object, effectively leaking a live reference to     Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the     global prototype. This issue has been patched in version 3.4.2.

    CVE-2026-32141:
    flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive()     phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested     or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the     Node.js process. This vulnerability is fixed in 3.4.0.

    CVE-2026-29074:
    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
    From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version     4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This     can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process     with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

    CVE-2026-27904:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs     produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic     backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()`     stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes.
    This is the most severe finding: it is triggered by the default `minimatch()` API with no special options,     and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.

    CVE-2026-27903:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs     unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR)     segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is     the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default     `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call     budget exists to bound this behavior. Any application where an attacker can influence the glob pattern     passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners     that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one     tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept     ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config     files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can     stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second     stall and does not require authentication in contexts where pattern input is part of the feature. Versions     10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.

    CVE-2026-26996:
    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
    Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob     pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the     test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine     backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number     of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively     forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is     vulnerable to DoS. This issue has been fixed in version 10.2.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6599e30e04 advisory.

    33.0.3 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cb5661d883 advisory.

    33.0.3 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2fed8dd674 advisory.

    33.0.3 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the axios Node.js module installed on the remote host is prior to 1.15.1. It is, therefore, affected by multiple vulnerabilities:

  - Prototype pollution gadgets in axios allow response tampering, data exfiltration, and request hijacking.
    (CVE-2026-42033)

  - Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects is set to 0. (CVE-2026-42034)

  - Header injection via prototype pollution in axios. (CVE-2026-42035)

  - Axios HTTP adapter streamed responses bypass maxContentLength. (CVE-2026-42036)

  - Axios no_proxy bypass via IP alias allows SSRF. (CVE-2026-42038)

  - Unbounded recursion in toFormData causes denial of service via deeply nested request data. (CVE-2026-42039)

  - Incomplete fix for CVE-2025-62718 - NO_PROXY protection bypassed via RFC 1122 loopback subnet (127.0.0.0/8)     in axios 1.15.0. (CVE-2026-42043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype
    pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject
    arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data
    payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and
    Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the
    attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The
    vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need
    to originate from Axios itself — any prototype pollution primitive in any dependency in the application's
    dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
    (CVE-2026-42035)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype     pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject     arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data     payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and     Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the     attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The     vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need     to originate from Axios itself  any prototype pollution primitive in any dependency in the application's     dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
    (CVE-2026-42035)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
324569	RHEL 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:34160)	Nessus	Red Hat Local Security Checks	high
319720	TencentOS Server 4: grafana (TSSA-2026:0295)	Nessus	Tencent Local Security Checks	critical
313733	Fedora 43 : nextcloud (2026-6599e30e04)	Nessus	Fedora Local Security Checks	medium
313662	Fedora 44 : nextcloud (2026-cb5661d883)	Nessus	Fedora Local Security Checks	medium
313661	Fedora 42 : nextcloud (2026-2fed8dd674)	Nessus	Fedora Local Security Checks	medium
313224	Node.js Module axios < 1.15.1 Multiple Vulnerabilities	Nessus	Misc.	medium
441082	SCA: security update for axios (GHSA-6chq-wfr3-2hj9)	Tenable Cloud Security	SCA Checks	high
441082	SCA: security update for axios (GHSA-6chq-wfr3-2hj9)	Tenable Self-Hosted Container Security	SCA Checks	high
310490	Linux Distros Unpatched Vulnerability : CVE-2026-42035	Nessus	Misc.	high

Detections

Analytics

CVE-2026-42035

high

Tenable Plugins

high

critical

medium

medium

medium

medium

high

high

high