p PatchFirst

CVE-2026-40175

CVE-2026-40175 · Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

CVSS 4.8 · Medium · EPSS 1.9% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • axios

    Versions
    • >= 1.0.0, < 1.15.0: Affected
    • < 0.31.0: Affected

    No fix published

  • node-axios Debian:12

    Versions
    • 1.11.0+dfsg-1
    • 1.12.1+dfsg-1
    • 1.13.1+dfsg-1
    • 1.13.2+dfsg-1
    • 1.14.0+dfsg-1
    • 1.15.0-1
    • 1.15.2-1
    • 1.16.0-1
    • 1.18.0-1
    • 1.19.0-1
    • 1.2.1+dfsg-1
    • 1.2.1+dfsg-1+deb12u1
    • 1.20.0-1
    • 1.5.1+dfsg-1
    • 1.6.2+dfsg-1
    • 1.6.8+dfsg-1
    • 1.6.8+dfsg-2
    • 1.7.3+dfsg-1
    • 1.7.4+dfsg-1
    • 1.7.7+dfsg-1
    • 1.7.9+dfsg-1
    • 1.8.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-axios Debian:13

    Versions
    • 1.11.0+dfsg-1
    • 1.12.1+dfsg-1
    • 1.13.1+dfsg-1
    • 1.13.2+dfsg-1
    • 1.14.0+dfsg-1
    • 1.15.0-1
    • 1.15.2-1
    • 1.16.0-1
    • 1.18.0-1
    • 1.19.0-1
    • 1.20.0-1
    • 1.8.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-axios Debian:14

    Versions
    • 1.11.0+dfsg-1
    • 1.12.1+dfsg-1
    • 1.13.1+dfsg-1
    • 1.13.2+dfsg-1
    • 1.14.0+dfsg-1
    • 1.8.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1.15.0-1

    Update to 1.15.0-1

  • axios npm

    Affected ranges
    • SEMVER: ≥ 1.0.0, < 1.15.0

    Update to 1.15.0

  • axios npm

    Affected ranges
    • SEMVER: < 0.31.0

    Update to 0.31.0

  • node-axios Ubuntu:Pro:20.04:LTS

    Versions
    • 0.19.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 0.19.0+dfsg-2ubuntu0.1~esm1

    Update to 0.19.0+dfsg-2ubuntu0.1~esm1

  • node-axios Ubuntu:Pro:22.04:LTS

    Versions
    • 0.21.1+dfsg-1
    • 0.23.0+dfsg-2
    • 0.24.0+dfsg-1
    • 0.25.0+dfsg-2
    • 0.26.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 0.26.0+dfsg-1ubuntu0.1~esm1

    Update to 0.26.0+dfsg-1ubuntu0.1~esm1

  • node-axios Ubuntu:Pro:24.04:LTS

    Versions
    • 1.2.1+dfsg-1
    • 1.5.1+dfsg-1
    • 1.6.2+dfsg-1
    • 1.6.8+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 1.6.8+dfsg-2ubuntu0.1~esm1

    Update to 1.6.8+dfsg-2ubuntu0.1~esm1

  • node-axios Ubuntu:25.10

    Versions
    • 1.7.9+dfsg-1
    • 1.8.4+dfsg-1
    • 1.11.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-axios Ubuntu:Pro:26.04:LTS

    Versions
    • 1.11.0+dfsg-1
    • 1.12.1+dfsg-1
    • 1.13.2+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: < 1.13.2+dfsg-1ubuntu0.1~esm1

    Update to 1.13.2+dfsg-1ubuntu0.1~esm1

Original sources

Check your server →