Came across something in package-lock.json around line 2584 that looked worth flagging.
Vulnerability: CVE-2026-42033 (HIGH) in axios 1.13.5 (package-lock.json:2584-2594). Axios reads certain configuration and response-parsing properties without a hasOwnProperty guard. If Object.prototype is polluted by any co-dependency in the same process, an attacker can inject keys that axios picks up implicitly, allowing them to (a) silently intercept and tamper with every JSON response before the application processes it, or (b) fully hijack the underlying HTTP transport, exposing request credentials, headers, and bodies. Impact: silent data manipulation, credential/token exfiltration, and potential server-side request compromise — especially dangerous in Node.js services that make authenticated API calls. Risk: HIGH. Note the exploit requires a second dependency that pollutes Object.prototype; the definitive remediation is upgrading to the patched release (1.15.1 or 0.31.1 for the 0.x line). The lockfile alone should not be hand-edited — bump the dependency in package.json and regenerate the lockfile.
Something like this might fix it:
--- a/package.json
+++ b/package.json
@@
"dependencies": {
- "axios": "^1.13.5",
+ "axios": "^1.15.1",
...
}
Then regenerate the lockfile (updates package-lock.json lines 2584-2594) so the resolved version and integrity hash match the patched release:
```bash
npm install axios@^1.15.1
# or equivalently:
npm audit fix
```
--- a/package-lock.json
+++ b/package-lock.json
@@ -2584,9 +2584,9 @@
"node_modules/axios": {
- "version": "1.13.5",
- "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
- "integrity": "sha512-<old-hash>",
+ "version": "1.15.1",
+ "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.1.tgz",
+ "integrity": "sha512-<new-hash>",
"engines": {
"node": ">=14.0.0"
}
Additional hardening (recommended): audit dependencies for prototype-pollution sources (run `npm audit` for CVEs like CVE-2022-25901-style issues) since this axios bug is only exploitable when Object.prototype is polluted by another package; consider freezing Object.prototype in entry-point code (`Object.freeze(Object.prototype)`) as a defense-in-depth measure, and add a CI gate (e.g., `npm audit --audit-level=high` or osv-scanner) to block future vulnerable axios versions.For reference: rule CVE-2026-42033. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
package-lock.jsonaround line 2584 that looked worth flagging.Vulnerability: CVE-2026-42033 (HIGH) in axios 1.13.5 (package-lock.json:2584-2594). Axios reads certain configuration and response-parsing properties without a hasOwnProperty guard. If Object.prototype is polluted by any co-dependency in the same process, an attacker can inject keys that axios picks up implicitly, allowing them to (a) silently intercept and tamper with every JSON response before the application processes it, or (b) fully hijack the underlying HTTP transport, exposing request credentials, headers, and bodies. Impact: silent data manipulation, credential/token exfiltration, and potential server-side request compromise — especially dangerous in Node.js services that make authenticated API calls. Risk: HIGH. Note the exploit requires a second dependency that pollutes Object.prototype; the definitive remediation is upgrading to the patched release (1.15.1 or 0.31.1 for the 0.x line). The lockfile alone should not be hand-edited — bump the dependency in package.json and regenerate the lockfile.
Something like this might fix it:
For reference: rule
CVE-2026-42033. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.