CVE-2026-40175
EUVD-2026-2157310.04.2026, 20:16
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| axios | axios | 𝑥 < 0.31.0 |
| axios | axios | 1.0.0 ≤ 𝑥 < 1.15.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Siemens | gWAP | 𝑥 < V3.1.1 | ADP |
Debian Releases
Vulnerability Media Exposure
References