{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Stackable GmbH and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "product-security@stackable.tech", "issuing_authority": "The Stackable Security Team is responsible for vulnerability handling across all Stackable offerings.", "name": "Stackable GmbH", "namespace": "https://www.stackable.tech/" }, "title": "Stackable Security Advisory for: CVE-2026-42035", "tracking": { "current_release_date": "2026-07-13T09:47:39.608037Z", "generator": { "engine": { "name": "SecObserve", "version": "1.54.0" } }, "id": "CVE-2026-42035", "initial_release_date": "2026-07-13T09:47:39.608037Z", "revision_history": [ { "date": "2026-07-13T09:47:39.608037Z", "number": "1", "summary": "Initial release" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "3.1.0-stackable26.3.0-amd64", "product": { "name": "opensearch-dashboards:3.1.0-stackable26.3.0-amd64", "product_id": "pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_identification_helper": { "purl": "pkg:oci/opensearch-dashboards@sha256:07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech/sdp/opensearch-dashboards" } } }, { "category": "product_version", "name": "3.4.0-stackable26.3.0-amd64", "product": { "name": "opensearch-dashboards:3.4.0-stackable26.3.0-amd64", "product_id": "pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_identification_helper": { "purl": "pkg:oci/opensearch-dashboards@sha256:77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech/sdp/opensearch-dashboards" } } }, { "category": "product_version", "name": "3.1.0-stackable25.11.0-amd64", "product": { "name": "opensearch-dashboards:3.1.0-stackable25.11.0-amd64", "product_id": "pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_identification_helper": { "purl": "pkg:oci/opensearch-dashboards@sha256:469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech/sdp/opensearch-dashboards" } } } ], "category": "product_name", "name": "opensearch-dashboards" }, { "branches": [ { "category": "product_version", "name": "479-stackable26.3.0-amd64", "product": { "name": "trino:479-stackable26.3.0-amd64", "product_id": "pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino", "product_identification_helper": { "purl": "pkg:oci/trino@sha256:0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech/sdp/trino" } } } ], "category": "product_name", "name": "trino" } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "3.1.0-stackable26.3.0-arm64", "product": { "name": "opensearch-dashboards:3.1.0-stackable26.3.0-arm64", "product_id": "pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_identification_helper": { "purl": "pkg:oci/opensearch-dashboards@sha256:64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech/sdp/opensearch-dashboards" } } }, { "category": "product_version", "name": "3.4.0-stackable26.3.0-arm64", "product": { "name": "opensearch-dashboards:3.4.0-stackable26.3.0-arm64", "product_id": "pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_identification_helper": { "purl": "pkg:oci/opensearch-dashboards@sha256:6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech/sdp/opensearch-dashboards" } } }, { "category": "product_version", "name": "3.1.0-stackable25.11.0-arm64", "product": { "name": "opensearch-dashboards:3.1.0-stackable25.11.0-arm64", "product_id": "pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_identification_helper": { "purl": "pkg:oci/opensearch-dashboards@sha256:cfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech/sdp/opensearch-dashboards" } } } ], "category": "product_name", "name": "opensearch-dashboards" } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Stackable" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "1.8.2", "product": { "name": "axios:1.8.2", "product_id": "pkg:npm/axios@1.8.2", "product_identification_helper": { "purl": "pkg:npm/axios@1.8.2" } } }, { "category": "product_version", "name": "1.12.1", "product": { "name": "axios:1.12.1", "product_id": "pkg:npm/axios@1.12.1", "product_identification_helper": { "purl": "pkg:npm/axios@1.12.1" } } }, { "category": "product_version", "name": "1.12.2", "product": { "name": "axios:1.12.2", "product_id": "pkg:npm/axios@1.12.2", "product_identification_helper": { "purl": "pkg:npm/axios@1.12.2" } } } ], "category": "product_name", "name": "axios" } ], "category": "vendor", "name": "unknown" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.8.2", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.12.1", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.12.2", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.8.2", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.12.1", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.12.2", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.8.2", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "product_id": "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, "product_reference": "pkg:npm/axios@1.8.2", "relates_to_product_reference": "pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:npm/axios@1.12.2@pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino", "product_id": "pkg:npm/axios@1.12.2@pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino" }, "product_reference": "pkg:npm/axios@1.12.2", "relates_to_product_reference": "pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-42035", "flags": [ { "label": "vulnerable_code_cannot_be_controlled_by_adversary", "product_ids": [ "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" ] }, { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "pkg:npm/axios@1.12.2@pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino" ] } ], "notes": [ { "category": "description", "text": "Axios: Header Injection via Prototype Pollution", "title": "Vulnerability description" } ], "product_status": { "known_not_affected": [ "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino" ] }, "references": [ { "category": "external", "summary": "Security Advisory", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42035" } ], "threats": [ { "category": "impact", "details": "CVE-2026-42035 is a prototype-pollution gadget rather than a standalone vulnerability. In the axios Node.js HTTP adapter (lib/adapters/http.js) a request with a data payload is duck-typed via isFormData()/isFunction(data.getHeaders) with no own-property check, so if Object.prototype has been polluted with getHeaders/append/pipe/on/once/Symbol.toStringTag an attacker can inject arbitrary outgoing HTTP headers. Per the advisory this needs two things: a separate prototype-pollution primitive elsewhere in the process, and axios sending a POST/PUT/PATCH.\n\nOpenSearch Dashboards runs axios in its Node.js server, so the http adapter is on the execute path. What is missing is a reachable, attacker-controlled prototype-pollution primitive in the Dashboards process that could add function-valued getHeaders/append/pipe keys to Object.prototype. Request handling and config are admin/developer-controlled and expose no path for an adversary to pollute Object.prototype with the required keys, so the gadget can never be triggered.", "product_ids": [ "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A07bc35fa25745504e972737069425a15e82c91e7d50d86b958e4459456ae6cd7?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A77e759bccc17ea743eb44494a66be94a6a10848021a9590f534b5c350faa20a5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A64700f008d8be4e27ccea22af52d2bcec5fc9b45f20ecd728e5a43c24d24c58e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.1@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.12.2@pkg:oci/opensearch-dashboards@sha256%3A6f0b0a0502777137d789562ae247076a6bf5ade92e9ece0ab0a316c48846dd0a?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3A469b6ed476f0c73e910d6229c68660c926d4ae76ba529bed5d8cf774dc18b0b5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards", "pkg:npm/axios@1.8.2@pkg:oci/opensearch-dashboards@sha256%3Acfe73e5e7a9c1ac28ddbf8d1d81b30870edc1d9ccc13a715c994e7eba2fdcba8?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fopensearch-dashboards" ] }, { "category": "impact", "details": "CVE-2026-42035 is a prototype-pollution gadget, and its sink lives only in the axios Node.js HTTP adapter (lib/adapters/http.js), where a data-bearing request is duck-typed via isFunction(data.getHeaders) with no own-property guard. A polluted Object.prototype carrying getHeaders/append/pipe/on/once can then inject outgoing headers. In trino-webui, axios is a direct dependency of the Vite React SPA (webapp-preview, src/api/base.ts), shipped as static assets and run in the browser. Browser-side axios uses the XHR adapter and never touches lib/adapters/http.js, so the vulnerable header-building code never runs.\n\nIt is also only a gadget, so it would further need a prototype-pollution primitive to add those keys to Object.prototype. The SPA has no such primitive.", "product_ids": [ "pkg:npm/axios@1.12.2@pkg:oci/trino@sha256%3A0778410d28890c0be1278aa52f9b3a4c79dc237404bbee4d6f03815e0fcfe103?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Ftrino" ] } ], "title": "CVE-2026-42035" } ] }