Skip to content
Fencer Vulns
high 8.1

CVE-2026-40175 json

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

published 2026-04-10 6 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-21573 , GHSA-fvcv-3m26-pcqx

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Patch / fix

  • npm axios 0.31.0, 1.15.0
  • Siemens gWAP V3.1.1
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.9-1.el9ap
  • Red Hat multicluster engine for Kubernetes 2.1 1777128790
  • Red Hat multicluster engine for Kubernetes 2.6 1778511348
  • Red Hat multicluster engine for Kubernetes 2.8 1778383863
  • Red Hat multicluster engine for Kubernetes 2.9 1777301444
  • Red Hat Network Observability (NETOBSERV) 1.11.0 1778508956, 1778510461
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126
  • Red Hat Red Hat Advanced Cluster Security 4.9 1779371594
  • Red Hat Red Hat Container Native Virtualization 4.12 1786029653
  • Red Hat Red Hat Container Native Virtualization 4.13 1786327570
  • Red Hat Red Hat Container Native Virtualization 4.14 1786328211
  • Red Hat Red Hat Container Native Virtualization 4.15 1786328346
  • Red Hat Red Hat Container Native Virtualization 4.16 1786328683
  • Red Hat Red Hat Container Native Virtualization 4.17 1786327616
  • Red Hat Red Hat Container Native Virtualization 4.18 1786328550
  • Red Hat Red Hat Container Native Virtualization 4.19 1785968159
  • Red Hat Red Hat Container Native Virtualization 4.20 1786329530
  • Red Hat Red Hat Container Native Virtualization 4.21 1786010898
  • Red Hat Red Hat Developer Hub 1.8 1776784286
  • Red Hat Red Hat Developer Hub 1.9 1777903262
  • Red Hat Red Hat Discovery 2 1778156756
  • Red Hat Red Hat Migration Toolkit 1.8 1780590717
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627, 1779189704
  • Red Hat Red Hat OpenShift Container Platform 4.14 1777997704
  • Red Hat Red Hat OpenShift Container Platform 4.15 1777994748
  • Red Hat Red Hat OpenShift Container Platform 4.16 1776827996
  • Red Hat Red Hat OpenShift Container Platform 4.19 1779249923
  • node-axios Debian 14 1.15.0-1

debian advisories DEBIAN-CVE-2026-40175

  • node-axios Ubuntu Pro 20.04 LTS 0.19.0+dfsg-2ubuntu0.1~esm1
  • node-axios Ubuntu Pro 22.04 LTS 0.26.0+dfsg-1ubuntu0.1~esm1
  • node-axios Ubuntu Pro 24.04 LTS 1.6.8+dfsg-2ubuntu0.1~esm1
  • node-axios Ubuntu Pro 26.04 LTS 1.13.2+dfsg-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-40175

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • receptor ansible automation platform 2.6 1.6.5-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.5-1.el9ap
  • receptorctl ansible automation platform 2.6 1.6.5-1.el10ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.5-1.el9ap
  • python3-click ansible automation platform developer 2.6, ansible automation platform 2.6 8.3.3-1.el10ap
  • python3.12-click ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 8.3.3-1.el9ap
  • python3.12-pillow ansible automation platform 2.6 12.2.0-1.el9ap
  • automation-controller ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.12-1.el9ap

red hat advisories RHSA-2026:24762

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40175 updated cvss 8.1

axios: Axios: Remote Code Execution via Prototype Pollution escalation

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9
    affected: no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 io.hawt-project
    affected: no fix available
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9
    affected: no fix available
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10 Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat Fuse 7 io.apicurio-apicurito
    affected: no fix planned “Will not fix”
  • Red Hat Trusted Artifact Signer rhtas/rhtas-console-ui-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: no fix available
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1778511348
    fixed: vendor fix RHSA-2026:17657
show 29 more
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1778383863
    fixed: vendor fix RHSA-2026:17699
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1777301444
    fixed: vendor fix RHSA-2026:11414
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine 1777128790
    fixed: vendor fix RHSA-2026:13542
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1778508956, network-observability 1778510461
    fixed: vendor fix RHSA-2026:16874
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1783451729
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1776927126
    fixed: vendor fix RHSA-2026:13548
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1779371594
    fixed: vendor fix RHSA-2026:20938
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.9-1.el9ap
    fixed: vendor fix RHSA-2026:24762
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Container Native Virtualization 4.12 container-native-virtualization/kubevirt-console-plugin 1786029653
    fixed: vendor fix RHSA-2026:53676
  • Red Hat Container Native Virtualization 4.13 container-native-virtualization/kubevirt-console-plugin-rhel9 1786327570
    fixed: vendor fix RHSA-2026:53735
  • Red Hat Container Native Virtualization 4.14 container-native-virtualization/kubevirt-console-plugin-rhel9 1786328211
    fixed: vendor fix RHSA-2026:53789
  • Red Hat Container Native Virtualization 4.15 container-native-virtualization/kubevirt-console-plugin-rhel9 1786328346
    fixed: vendor fix RHSA-2026:53840
  • Red Hat Container Native Virtualization 4.16 container-native-virtualization/kubevirt-console-plugin-rhel9 1786328683
    fixed: vendor fix RHSA-2026:53799
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/kubevirt-console-plugin-rhel9 1786327616
    fixed: vendor fix RHSA-2026:53661
  • Red Hat Container Native Virtualization 4.18 container-native-virtualization/kubevirt-console-plugin-rhel9 1786328550
    fixed: vendor fix RHSA-2026:53835
  • Red Hat Container Native Virtualization 4.19 container-native-virtualization/kubevirt-console-plugin-rhel9 1785968159
    fixed: vendor fix RHSA-2026:53736
  • Red Hat Container Native Virtualization 4.20 container-native-virtualization/kubevirt-console-plugin-rhel9 1786329530
    fixed: vendor fix RHSA-2026:53778
  • Red Hat Container Native Virtualization 4.21 container-native-virtualization/kubevirt-console-plugin-rhel9 1786010898
    fixed: vendor fix RHSA-2026:53752
  • Red Hat Developer Hub 1.8 rhdh 1776784286
    fixed: vendor fix RHSA-2026:9742
  • Red Hat Developer Hub 1.9 rhdh 1777903262
    fixed: vendor fix RHSA-2026:13826
  • Red Hat Discovery 2 discovery 1778156756
    fixed: vendor fix RHSA-2026:14937
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1780590717
    fixed: vendor fix RHSA-2026:25041
  • Red Hat OpenShift AI 3.3 rhoai 1778473763, rhoai 1778666987, rhoai 1779189627, rhoai 1779189704
    fixed: vendor fix RHSA-2026:19712
  • Red Hat OpenShift Container Platform 4.14 openshift4 1777997704
    fixed: vendor fix RHSA-2026:15091
  • Red Hat OpenShift Container Platform 4.15 openshift4 1777994748
    fixed: vendor fix RHSA-2026:14774
  • Red Hat OpenShift Container Platform 4.16 openshift4 1776827996
    fixed: vendor fix RHSA-2026:10104
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-monitoring-plugin-rhel9 1779249923
    fixed: vendor fix RHSA-2026:20041
  • Red Hat OpenShift Container Platform 4.20 openshift4 1778638503, openshift4 1778645099
    fixed: vendor fix RHSA-2026:17468

10 more fixed, 41 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

1.98% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm axios
>=1.0.0, <1.15.0
<0.31.0
1.15.0
0.31.0

Affected products

  • axios axios
  • Siemens gWAP
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Streams for Apache Kafka 3.2.0
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Network Observability (NETOBSERV) 1.11.0
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Container Native Virtualization 4.12
  • Red Hat Red Hat Container Native Virtualization 4.13
  • Red Hat Red Hat Container Native Virtualization 4.14
  • Red Hat Red Hat Container Native Virtualization 4.15
  • Red Hat Red Hat Container Native Virtualization 4.16
  • Red Hat Red Hat Container Native Virtualization 4.17
  • Red Hat Red Hat Container Native Virtualization 4.18
  • Red Hat Red Hat Container Native Virtualization 4.19
  • Red Hat Red Hat Container Native Virtualization 4.20
  • Red Hat Red Hat Container Native Virtualization 4.21
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel - HawtIO 4

Classification

Weakness
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
  • CWE-444 Inconsistent Interpretation of HTTP Requests
  • CWE-918 Server-Side Request Forgery
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.