← CVE Intelligence

CVE-2026-40175

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain PUBLISHED

Description (CNA)

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Affected (CNA)

Vendor / productVersions
axios / axiosaffected >= 1.0.0, < 1.15.0; affected < 0.31.0

CWE

CWE-113, CWE-444, CWE-918

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.

siemens-SADP

No English description supplied.

redhat-SADP

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.