PT-2026-32030 · Axios · Axios

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40175

NVD

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0.

Fix

HTTP Request/Response Smuggling

SSRF

Weakness Enumeration

CWE-444

CWE-918

CWE-113

Related Identifiers

CVE-2026-40175

Affected Products

Axios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40175 · Security Note
• https://github.com/axios/axios/pull/10660 · Note
• https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx · Note
• https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1 · Note
• https://github.com/axios/axios/releases/tag/v1.15.0 · Note