CVE-2026-40175 Security Details

CVE ID

CVE-2026-40175

CWE

CWE-113

CWE-444

CWE-915

CWE-918

CVE Description

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Published

Apr 11, 2026

CVSS Score & Severity

4.8Medium

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score

0.063%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

AxiosHeaders/constructor()

JS

dispatchRequest/sanitizeHeaderConfigValue()

JS

normalizeValue()

JSVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · axios/axiosPROJECT

GitHub · Advisory · GHSA-fvcv-3m26-pcqxTHIRD_PARTY