Description
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
Metrics
CVSS 3.1 4.8/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| axios | axios | >= 1.0.0, < 1.15.0; < 0.31.0 |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — |
| Red Hat | Streams for Apache Kafka 3.2.0 | — |
| Red Hat | multicluster engine for Kubernetes 2.1 | — |
| Red Hat | multicluster engine for Kubernetes 2.6 | — |
| Red Hat | multicluster engine for Kubernetes 2.8 | — |
| Red Hat | multicluster engine for Kubernetes 2.9 | — |
| Red Hat | Network Observability (NETOBSERV) 1.11.0 | — |
| Red Hat | Network Observability (NETOBSERV) 1.11.0 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | — |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | — |
| Red Hat | Red Hat Container Native Virtualization 4.12 | — |
| Red Hat | Red Hat Container Native Virtualization 4.13 | — |
| Red Hat | Red Hat Container Native Virtualization 4.14 | — |
| Red Hat | Red Hat Container Native Virtualization 4.15 | — |
| Red Hat | Red Hat Container Native Virtualization 4.16 | — |
| Red Hat | Red Hat Container Native Virtualization 4.17 | — |
| Red Hat | Red Hat Container Native Virtualization 4.18 | — |
| Red Hat | Red Hat Container Native Virtualization 4.19 | — |
| Red Hat | Red Hat Container Native Virtualization 4.20 | — |
| Red Hat | Red Hat Container Native Virtualization 4.21 | — |
| Red Hat | Red Hat Developer Hub 1.8 | — |
| Red Hat | Red Hat Developer Hub 1.9 | — |
| Red Hat | Red Hat Discovery 2 | — |
| Red Hat | Red Hat Migration Toolkit 1.8 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | — |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | — |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | — |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.0 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | — |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | — |
References
- https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9cPatch
- https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1Patch
- https://github.com/axios/axios/pull/10660Issue Tracking, Patch
- https://github.com/axios/axios/pull/10688Patch
- https://github.com/axios/axios/releases/tag/v0.31.0Release Notes
- https://github.com/axios/axios/releases/tag/v1.15.0Product, Release Notes
- https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqxExploit, Mitigation, Vendor Advisory
- https://github.com/axios/axios/pull/10660#issuecomment-4224168081Issue Tracking, Patch
- https://access.redhat.com/errata/RHSA-2026:10104
- https://access.redhat.com/errata/RHSA-2026:10153
- https://access.redhat.com/errata/RHSA-2026:10172
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:11414
- https://access.redhat.com/errata/RHSA-2026:13542
- https://access.redhat.com/errata/RHSA-2026:13548
- https://access.redhat.com/errata/RHSA-2026:13571
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14774
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:15091
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17474
- https://access.redhat.com/errata/RHSA-2026:17657
- https://access.redhat.com/errata/RHSA-2026:17699
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:53661
- https://access.redhat.com/errata/RHSA-2026:53676
- https://access.redhat.com/errata/RHSA-2026:53735
- https://access.redhat.com/errata/RHSA-2026:53736
- https://access.redhat.com/errata/RHSA-2026:53752
- https://access.redhat.com/errata/RHSA-2026:53778
- https://access.redhat.com/errata/RHSA-2026:53789
- https://access.redhat.com/errata/RHSA-2026:53799
- https://access.redhat.com/errata/RHSA-2026:53835
- https://access.redhat.com/errata/RHSA-2026:53840
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:8499
- https://access.redhat.com/errata/RHSA-2026:8500
- https://access.redhat.com/errata/RHSA-2026:8501
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-40175
- https://bugzilla.redhat.com/show_bug.cgi?id=2457432
- https://cert-portal.siemens.com/productcert/html/ssa-876049.html
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json
Timeline
- Published
- Apr 10, 2026
- Last modified
- Sep 9, 2026
- NVD status
- Modified