CVE-2026-40175
4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| axios | axios | >= 1.0.0, < 1.15.0 | affected |
| axios | axios | < 0.31.0 | affected |
Weaknesses
- CWE-113: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
- CWE-444: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CWE-918: CWE-918: Server-Side Request Forgery (SSRF)
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: total
Additional References
axios: Axios: Remote Code Execution via Prototype Pollution escalation
Additional References
- https://access.redhat.com/security/cve/CVE-2026-40175
- https://bugzilla.redhat.com/show_bug.cgi?id=2457432
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:13548
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:15091
- https://access.redhat.com/errata/RHSA-2026:14774
- https://access.redhat.com/errata/RHSA-2026:10104
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17474
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:8499
- https://access.redhat.com/errata/RHSA-2026:8500
- https://access.redhat.com/errata/RHSA-2026:8501
- https://access.redhat.com/errata/RHSA-2026:10172
- https://access.redhat.com/errata/RHSA-2026:10153
- https://access.redhat.com/errata/RHSA-2026:13571
- https://access.redhat.com/errata/RHSA-2026:13542
- https://access.redhat.com/errata/RHSA-2026:17657
- https://access.redhat.com/errata/RHSA-2026:17699
- https://access.redhat.com/errata/RHSA-2026:11414
References
- https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
- https://github.com/axios/axios/pull/10660
- https://github.com/axios/axios/pull/10688
- https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
- https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
- https://github.com/axios/axios/releases/tag/v0.31.0
- https://github.com/axios/axios/releases/tag/v1.15.0
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.