CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
| CWE | CWE-113 CWE-444 CWE-918 |
| Vendor | axios |
| Product | axios |
| Published | Apr 10, 2026 |
| Last Updated | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for axios axios
Be the first to know when new medium vulnerabilities affecting axios axios are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
axios / axios
>= 1.0.0, < 1.15.0 < 0.31.0
References
github.com: https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx github.com: https://github.com/axios/axios/pull/10660 github.com: https://github.com/axios/axios/pull/10688 github.com: https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c github.com: https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 github.com: https://github.com/axios/axios/releases/tag/v0.31.0 github.com: https://github.com/axios/axios/releases/tag/v1.15.0 github.com: https://github.com/axios/axios/pull/10660#issuecomment-4224168081 cert-portal.siemens.com: https://cert-portal.siemens.com/productcert/html/ssa-876049.html access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-40175 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2457432 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24762 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16874 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13548 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20938 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9742 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13826 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14937 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25041 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19712 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:15091 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14774 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10104 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20041 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17468 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17474 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10175 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8483 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8484 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8490 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8491 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8493 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8499 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8500 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8501 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10172 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10153 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13571 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13542 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17657 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17699 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11414