CVE-2026-40175

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
References
Link Resource
https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c Patch
https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 Patch
https://github.com/axios/axios/pull/10660 Issue Tracking Patch
https://github.com/axios/axios/pull/10688 Patch
https://github.com/axios/axios/releases/tag/v0.31.0 Release Notes
https://github.com/axios/axios/releases/tag/v1.15.0 Product Release Notes
https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx Exploit Mitigation Vendor Advisory
https://github.com/axios/axios/pull/10660#issuecomment-4224168081 Issue Tracking Patch
https://access.redhat.com/errata/RHSA-2026:10104
https://access.redhat.com/errata/RHSA-2026:10153
https://access.redhat.com/errata/RHSA-2026:10172
https://access.redhat.com/errata/RHSA-2026:10175
https://access.redhat.com/errata/RHSA-2026:11414
https://access.redhat.com/errata/RHSA-2026:13542
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:13571
https://access.redhat.com/errata/RHSA-2026:13826
https://access.redhat.com/errata/RHSA-2026:14774
https://access.redhat.com/errata/RHSA-2026:14937
https://access.redhat.com/errata/RHSA-2026:15091
https://access.redhat.com/errata/RHSA-2026:16874
https://access.redhat.com/errata/RHSA-2026:17468
https://access.redhat.com/errata/RHSA-2026:17474
https://access.redhat.com/errata/RHSA-2026:17657
https://access.redhat.com/errata/RHSA-2026:17699
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:20041
https://access.redhat.com/errata/RHSA-2026:20938
https://access.redhat.com/errata/RHSA-2026:24762
https://access.redhat.com/errata/RHSA-2026:25041
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/errata/RHSA-2026:8483
https://access.redhat.com/errata/RHSA-2026:8484
https://access.redhat.com/errata/RHSA-2026:8490
https://access.redhat.com/errata/RHSA-2026:8491
https://access.redhat.com/errata/RHSA-2026:8493
https://access.redhat.com/errata/RHSA-2026:8499
https://access.redhat.com/errata/RHSA-2026:8500
https://access.redhat.com/errata/RHSA-2026:8501
https://access.redhat.com/errata/RHSA-2026:9742
https://access.redhat.com/security/cve/CVE-2026-40175
https://bugzilla.redhat.com/show_bug.cgi?id=2457432
https://cert-portal.siemens.com/productcert/html/ssa-876049.html
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*

History

09 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36882 -

30 Jun 2026, 03:19

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:10104 -
  • () https://access.redhat.com/errata/RHSA-2026:10153 -
  • () https://access.redhat.com/errata/RHSA-2026:10172 -
  • () https://access.redhat.com/errata/RHSA-2026:10175 -
  • () https://access.redhat.com/errata/RHSA-2026:11414 -
  • () https://access.redhat.com/errata/RHSA-2026:13542 -
  • () https://access.redhat.com/errata/RHSA-2026:13548 -
  • () https://access.redhat.com/errata/RHSA-2026:13571 -
  • () https://access.redhat.com/errata/RHSA-2026:13826 -
  • () https://access.redhat.com/errata/RHSA-2026:14774 -
  • () https://access.redhat.com/errata/RHSA-2026:14937 -
  • () https://access.redhat.com/errata/RHSA-2026:15091 -
  • () https://access.redhat.com/errata/RHSA-2026:16874 -
  • () https://access.redhat.com/errata/RHSA-2026:17468 -
  • () https://access.redhat.com/errata/RHSA-2026:17474 -
  • () https://access.redhat.com/errata/RHSA-2026:17657 -
  • () https://access.redhat.com/errata/RHSA-2026:17699 -
  • () https://access.redhat.com/errata/RHSA-2026:19712 -
  • () https://access.redhat.com/errata/RHSA-2026:20041 -
  • () https://access.redhat.com/errata/RHSA-2026:20938 -
  • () https://access.redhat.com/errata/RHSA-2026:24762 -
  • () https://access.redhat.com/errata/RHSA-2026:25041 -
  • () https://access.redhat.com/errata/RHSA-2026:8483 -
  • () https://access.redhat.com/errata/RHSA-2026:8484 -
  • () https://access.redhat.com/errata/RHSA-2026:8490 -
  • () https://access.redhat.com/errata/RHSA-2026:8491 -
  • () https://access.redhat.com/errata/RHSA-2026:8493 -
  • () https://access.redhat.com/errata/RHSA-2026:8499 -
  • () https://access.redhat.com/errata/RHSA-2026:8500 -
  • () https://access.redhat.com/errata/RHSA-2026:8501 -
  • () https://access.redhat.com/errata/RHSA-2026:9742 -
  • () https://access.redhat.com/security/cve/CVE-2026-40175 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2457432 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json -
CWE CWE-915

20 May 2026, 02:16

Type Values Removed Values Added
Summary (en) Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1. (en) Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

12 May 2026, 13:17

Type Values Removed Values Added
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-876049.html -

21 Apr 2026, 19:44

Type Values Removed Values Added
First Time Axios axios
Axios
References () https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c - () https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c - Patch
References () https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 - () https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 - Patch
References () https://github.com/axios/axios/pull/10660 - () https://github.com/axios/axios/pull/10660 - Issue Tracking, Patch
References () https://github.com/axios/axios/pull/10688 - () https://github.com/axios/axios/pull/10688 - Patch
References () https://github.com/axios/axios/releases/tag/v0.31.0 - () https://github.com/axios/axios/releases/tag/v0.31.0 - Release Notes
References () https://github.com/axios/axios/releases/tag/v1.15.0 - () https://github.com/axios/axios/releases/tag/v1.15.0 - Product, Release Notes
References () https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx - () https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx - Exploit, Mitigation, Vendor Advisory
References () https://github.com/axios/axios/pull/10660#issuecomment-4224168081 - () https://github.com/axios/axios/pull/10660#issuecomment-4224168081 - Issue Tracking, Patch
CPE cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*

16 Apr 2026, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 10.0
v2 : unknown
v3 : 4.8

14 Apr 2026, 16:16

Type Values Removed Values Added
Summary (en) Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0. (en) Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.
References
  • () https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c -
  • () https://github.com/axios/axios/pull/10688 -
  • () https://github.com/axios/axios/releases/tag/v0.31.0 -

13 Apr 2026, 10:16

Type Values Removed Values Added
References
  • () https://github.com/axios/axios/pull/10660#issuecomment-4224168081 -

10 Apr 2026, 20:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-04-10 20:16

Updated : 2026-07-20 12:19


NVD link : CVE-2026-40175

Mitre link : CVE-2026-40175

CVE.ORG link : CVE-2026-40175


JSON object : View

Products Affected

axios

  • axios
CWE
CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-918

Server-Side Request Forgery (SSRF)

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes