Vulnerabilities CVE-2026-40175

CVE-2026-40175

Medium

Open

TLP:CLEAR

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Details

CVSS Score: 4.8
EPSS Score ⓘ: 1.88%

77.5th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Confidence: 90%
Published: Apr 10, 2026
Last Modified: Aug 12, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.