CVE Feed

    Dashboard / CVE / CVE-2026-40175

    CVE-2026-40175

    Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

    Published:Apr 10, 2026
    Last Modified:Aug 12, 2026
    EPS:Apr 10, 2026
    EPSS Score:0.01882
    CVSS Score:4.8

    Affected Products

    Vendor
    Axios
    Product
    Axios

    Exploits

    https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqxhttps://github.com/0xBlackash/CVE-2026-40175https://github.com/LeeKangHyun/axios-security-guidehttps://github.com/pjt3591oo/CVE-2026-40175-pochttps://github.com/surri/audit-axios

    Related CVEs

    CVE-2026-67321 (CVSS 6.9) — axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFor…
    CVE-2026-67318 (CVSS 6.3) — axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed …
    CVE-2026-67319 (CVSS 6.3) — axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option object…
    CVE-2026-67312 (CVSS 6.3) — axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDa…
    CVE-2026-67315 (CVSS 6.9) — axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address i…
    CVE-2026-67316 (CVSS 6.3) — axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.p…
    CVE-2026-67320 (CVSS 8.3) — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. …
    CVE-2026-67313 (CVSS 6.3) — axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData fiel…
    CVE-2026-67314 (CVSS 6.3) — axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handl…
    CVE-2026-67317 (CVSS 6.3) — axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t…

    References

    https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
    https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
    https://github.com/axios/axios/pull/10660
    https://github.com/axios/axios/pull/10688
    https://github.com/axios/axios/releases/tag/v0.31.0
    https://github.com/axios/axios/releases/tag/v1.15.0
    https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
    https://github.com/axios/axios/pull/10660#issuecomment-4224168081
    https://access.redhat.com/errata/RHSA-2026:10104
    https://access.redhat.com/errata/RHSA-2026:10153
    https://access.redhat.com/errata/RHSA-2026:10172
    https://access.redhat.com/errata/RHSA-2026:10175
    https://access.redhat.com/errata/RHSA-2026:11414
    https://access.redhat.com/errata/RHSA-2026:13542
    https://access.redhat.com/errata/RHSA-2026:13548
    https://access.redhat.com/errata/RHSA-2026:13571
    https://access.redhat.com/errata/RHSA-2026:13826
    https://access.redhat.com/errata/RHSA-2026:14774
    https://access.redhat.com/errata/RHSA-2026:14937
    https://access.redhat.com/errata/RHSA-2026:15091
    https://access.redhat.com/errata/RHSA-2026:16874
    https://access.redhat.com/errata/RHSA-2026:17468
    https://access.redhat.com/errata/RHSA-2026:17474
    https://access.redhat.com/errata/RHSA-2026:17657
    https://access.redhat.com/errata/RHSA-2026:17699
    https://access.redhat.com/errata/RHSA-2026:19712
    https://access.redhat.com/errata/RHSA-2026:20041
    https://access.redhat.com/errata/RHSA-2026:20938
    https://access.redhat.com/errata/RHSA-2026:24762
    https://access.redhat.com/errata/RHSA-2026:25041
    https://access.redhat.com/errata/RHSA-2026:36882
    https://access.redhat.com/errata/RHSA-2026:53661
    https://access.redhat.com/errata/RHSA-2026:53676
    https://access.redhat.com/errata/RHSA-2026:53735
    https://access.redhat.com/errata/RHSA-2026:53736
    https://access.redhat.com/errata/RHSA-2026:53752
    https://access.redhat.com/errata/RHSA-2026:53778
    https://access.redhat.com/errata/RHSA-2026:53789
    https://access.redhat.com/errata/RHSA-2026:53799
    https://access.redhat.com/errata/RHSA-2026:53835
    https://access.redhat.com/errata/RHSA-2026:53840
    https://access.redhat.com/errata/RHSA-2026:8483
    https://access.redhat.com/errata/RHSA-2026:8484
    https://access.redhat.com/errata/RHSA-2026:8490
    https://access.redhat.com/errata/RHSA-2026:8491
    https://access.redhat.com/errata/RHSA-2026:8493
    https://access.redhat.com/errata/RHSA-2026:8499
    https://access.redhat.com/errata/RHSA-2026:8500
    https://access.redhat.com/errata/RHSA-2026:8501
    https://access.redhat.com/errata/RHSA-2026:9742
    https://access.redhat.com/security/cve/CVE-2026-40175
    https://bugzilla.redhat.com/show_bug.cgi?id=2457432
    https://cert-portal.siemens.com/productcert/html/ssa-876049.html
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High