CVE-2026-42041: Prototype Pollution Gadget in Axios Leading to Authentication Bypass Vulnerability ID: CVE-2026-42041 CVSS Score: 4.8 Published: 2026-05-05 Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution gadget in the configuration merging logic. This vulnerability allows an attacker to bypass authentication mechanisms by leveraging a separate prototype pollution flaw to manipulate the HTTP response validation process. TL;DR A flaw in the Axios configuration merging process allows a polluted Object prototype to overwrite the validateStatus function. This causes the client to treat 4xx and 5xx error responses as successful, potentially bypassing authentication and error-handling checks.…