CVE-2026-42040: Null Byte Injection via Improper Parameter Serialization in Axios

Vulnerability ID: CVE-2026-42040

CVSS Score: 3.7

Published: 2026-05-05

Axios versions prior to 0.31.1 and 1.x versions prior to 1.15.1 contain a Null Byte Injection vulnerability (CWE-626) in the AxiosURLSearchParams module. A logic defect in the internal parameter encoder incorrectly reverts safely encoded null bytes (%00) back into raw null byte characters. This flaw can facilitate path truncation attacks or security filter bypasses when interacting with vulnerable downstream systems.

TL;DR

A logic flaw in Axios's URL parameter serializer reverts safely encoded null bytes (%00) back to raw null characters.…