Skip to content
Heist/ feed
Back to feed
Medium

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Type: advisorySources: OSV

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-40175
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 03:31 UTC · Revision 1

Source evidence

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

core-osv · Original source

Published 10 Apr 2026, 19:23 UTC

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

osv:CVE-2026-40175
Complete source record
{
  "id": "8dbe64a5c61e7108c19c83311ac95b42dbc4478d6337d6964aad4a65c6c6c431",
  "url": "https://osv.dev/vulnerability/CVE-2026-40175",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain",
    "summary": "Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.",
    "evidence": "osv:CVE-2026-40175",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-40175",
      "aliases": [
        "CVE-2026-40175",
        "GHSA-fvcv-3m26-pcqx"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/axios/axios",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5073eca0edd37b13a0e39dcb48794d779b7dff8d"
                },
                {
                  "introduced": "484aa4fe6addccbd32206a31eb3d2d000843066e"
                },
                {
                  "fixed": "772a4e54ecc4cc2421e2b746daff0aca10f359d7"
                },
                {
                  "fixed": "03cdfc99e8db32a390e12128208b6778492cee9c"
                },
                {
                  "fixed": "363185461b90b1b78845dc8a99a1f103d9b122a1"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.31.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "1.0.0"
                      },
                      {
                        "fixed": "1.15.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "03cdfc99e8db32a390e12128208b6778492cee9c"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "363185461b90b1b78845dc8a99a1f103d9b122a1"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5073eca0edd37b13a0e39dcb48794d779b7dff8d"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.31.0"
                  },
                  {
                    "range": [
                      {
                        "fixed": "772a4e54ecc4cc2421e2b746daff0aca10f359d7"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.15.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.14.0",
            "v1.13.6",
            "v0.30.3",
            "v0.30.2",
            "v1.13.5",
            "v1.13.4",
            "v1.13.3",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v0.30.1",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v0.30.0",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v0.29.0",
            "v1.7.9",
            "v1.7.8",
            "v1.7.7",
            "v1.7.6",
            "v1.7.5",
            "v1.7.4",
            "v1.7.3",
            "v1.7.2",
            "v0.28.1",
            "v1.7.1",
            "v1.7.0",
            "v1.7.0-beta.2",
            "v1.7.0-beta.1",
            "v1.7.0-beta.0",
            "v1.6.8",
            "v1.6.7",
            "v0.28.0",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.0",
            "v1.3.6",
            "v1.3.5",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.6",
            "v1.2.5",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "1.2.2",
            "v1.2.1",
            "v1.2.0",
            "1.2.0-alpha.1",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.0",
            "v0.27.2",
            "v0.27.1",
            "v0.27.0",
            "v0.26.0",
            "v0.26.1",
            "v0.25.0",
            "v0.24.0",
            "v0.23.0",
            "0.21.3",
            "v0.21.2",
            "v0.21.0",
            "v0.20.0",
            "v0.20.0-0",
            "v0.19.2",
            "0.19.1",
            "v0.19.1",
            "v0.19.0",
            "v0.18.0",
            "v0.19.0-beta.1",
            "v0.17.1",
            "v0.17.0",
            "v0.16.2",
            "v0.16.1",
            "v0.16.0",
            "v0.15.3",
            "v0.15.2",
            "v0.15.1",
            "v0.15.0",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.1",
            "v0.9.0",
            "v0.8.1",
            "v0.8.0",
            "v0.7.0",
            "v0.6.0",
            "v0.5.4",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40175.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.438927432Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-876049.html",
        "https://github.com/axios/axios/releases/tag/v0.31.0",
        "https://github.com/axios/axios/releases/tag/v1.15.0",
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json",
        "https://access.redhat.com/errata/RHSA-2026:10104",
        "https://access.redhat.com/errata/RHSA-2026:10153",
        "https://access.redhat.com/errata/RHSA-2026:10172",
        "https://access.redhat.com/errata/RHSA-2026:10175",
        "https://access.redhat.com/errata/RHSA-2026:11414",
        "https://access.redhat.com/errata/RHSA-2026:13542",
        "https://access.redhat.com/errata/RHSA-2026:13548",
        "https://access.redhat.com/errata/RHSA-2026:13571",
        "https://access.redhat.com/errata/RHSA-2026:13826",
        "https://access.redhat.com/errata/RHSA-2026:14774",
        "https://access.redhat.com/errata/RHSA-2026:14937",
        "https://access.redhat.com/errata/RHSA-2026:15091",
        "https://access.redhat.com/errata/RHSA-2026:16874",
        "https://access.redhat.com/errata/RHSA-2026:17468",
        "https://access.redhat.com/errata/RHSA-2026:17474",
        "https://access.redhat.com/errata/RHSA-2026:17657",
        "https://access.redhat.com/errata/RHSA-2026:17699",
        "https://access.redhat.com/errata/RHSA-2026:19712",
        "https://access.redhat.com/errata/RHSA-2026:20041",
        "https://access.redhat.com/errata/RHSA-2026:20938",
        "https://access.redhat.com/errata/RHSA-2026:24762",
        "https://access.redhat.com/errata/RHSA-2026:25041",
        "https://access.redhat.com/errata/RHSA-2026:36882",
        "https://access.redhat.com/errata/RHSA-2026:53661",
        "https://access.redhat.com/errata/RHSA-2026:53676",
        "https://access.redhat.com/errata/RHSA-2026:53735",
        "https://access.redhat.com/errata/RHSA-2026:53736",
        "https://access.redhat.com/errata/RHSA-2026:53752",
        "https://access.redhat.com/errata/RHSA-2026:53778",
        "https://access.redhat.com/errata/RHSA-2026:53789",
        "https://access.redhat.com/errata/RHSA-2026:53799",
        "https://access.redhat.com/errata/RHSA-2026:53835",
        "https://access.redhat.com/errata/RHSA-2026:53840",
        "https://access.redhat.com/errata/RHSA-2026:8483",
        "https://access.redhat.com/errata/RHSA-2026:8484",
        "https://access.redhat.com/errata/RHSA-2026:8490",
        "https://access.redhat.com/errata/RHSA-2026:8491",
        "https://access.redhat.com/errata/RHSA-2026:8493",
        "https://access.redhat.com/errata/RHSA-2026:8499",
        "https://access.redhat.com/errata/RHSA-2026:8500",
        "https://access.redhat.com/errata/RHSA-2026:8501",
        "https://access.redhat.com/errata/RHSA-2026:9742",
        "https://access.redhat.com/security/cve/CVE-2026-40175",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40175.json",
        "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2457432",
        "https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c",
        "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
        "https://github.com/axios/axios/pull/10660",
        "https://github.com/axios/axios/pull/10660#issuecomment-4224168081",
        "https://github.com/axios/axios/pull/10688"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-113",
          "CWE-444",
          "CWE-918"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40175.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-40175",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 509861,
  "published_at": "2026-04-10T19:23:52.285+00:00"
}