Search/CVE-2026-40175
● CVE — Medium

CVE-2026-40175

VendoraxiosProductaxiosDiscoveredApr 10, 2026UpdatedSep 9, 2026

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

View graph Watch Export
CVSS v3.1
4.8 MEDIUM
EPSS
1.95%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
3
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 14, 2026 → Oct 26, 2026
▲ 0.07pp
1.88% → 1.95% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityLOW
IntegrityLOW
AvailabilityNONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Connections
8 relationships
Timeline
disclosure → media coverage
Apr 10, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 9, 2026
Apr 14, 2026
acn.gov.it reports: Axios: disponibile PoC per lo sfruttamento della CVE-2026-40175
Apr 19, 2026
itmedia.co.jp reports: 脆弱性スコア10/10の“独り歩き”に警鐘――Axiosの「深刻な欠陥」は成立困難との指摘
Aug 13, 2026
ubuntu.com reports: USN-8638-1: Axios vulnerabilities
Public PoC (4)
github.com/0xBlackash/CVE-2026-40175github.com/surri/audit-axiosgithub.com/LeeKangHyun/axios-security-guidegithub.com/pjt3591oo/CVE-2026-40175-poc
Unverified third-party code — review before executing.