CVE-2026-40175
MediumCVSS 4.8Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
A vulnerability in Axios versions prior to 1.15.0 and 0.3.1 allows a gadget-style attack chain where prototype pollution in a third-party dependency can be leveraged to inject unsanitized header values into outbound HTTP requests.
Risk Assessment
The organization is at risk of sending unsanitized HTTP headers, which could lead to header injection attacks, session hijacking, or other security breaches in the application.
Recommendation
Immediately update the Axios library to version 1.15.0 or 0.3.1, which contain the fix for this vulnerability.
Original NVD description (English source)
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.