Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee50c21f92 advisory.

    33.0.6 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5afe6630dc advisory.

    33.0.6 Release

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode()
    function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that
    reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the
    safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is
    limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and
    0.31.1. (CVE-2026-42040)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode()     function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that     reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the     safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is     limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and     0.31.1. (CVE-2026-42040)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325136	Fedora 44 : nextcloud (2026-ee50c21f92)	Nessus	Fedora Local Security Checks	high
325111	Fedora 43 : nextcloud (2026-5afe6630dc)	Nessus	Fedora Local Security Checks	high
441073	SCA: security update for axios (GHSA-xhjh-pmcv-23jw)	Tenable Cloud Security	SCA Checks	low
441073	SCA: security update for axios (GHSA-xhjh-pmcv-23jw)	Tenable Self-Hosted Container Security	SCA Checks	low
310463	Linux Distros Unpatched Vulnerability : CVE-2026-42040	Nessus	Misc.	low

Detections

Analytics

CVE-2026-42040

low

Tenable Plugins

high

high

low

low

low