Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (axios axios)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.95 % · percentile 80 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
Weaknesses (CWE)
- CWE-113 — Improper Neutralization of CRLF Sequences in HTTP Headers
- CWE-444 — Inconsistent Interpretation of HTTP Requests
- CWE-918 — Server-Side Request Forgery
- CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes
References
- https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
- https://github.com/axios/axios/pull/10660
- https://github.com/axios/axios/pull/10688
- https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
- https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
- https://github.com/axios/axios/releases/tag/v0.31.0
- https://github.com/axios/axios/releases/tag/v1.15.0
- https://github.com/axios/axios/pull/10660#issuecomment-4224168081
- https://cert-portal.siemens.com/productcert/html/ssa-876049.html
- https://access.redhat.com/security/cve/CVE-2026-40175
- https://bugzilla.redhat.com/show_bug.cgi?id=2457432
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40175.json
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:13548
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:53676
- https://access.redhat.com/errata/RHSA-2026:53735
- https://access.redhat.com/errata/RHSA-2026:53789
- https://access.redhat.com/errata/RHSA-2026:53840
- https://access.redhat.com/errata/RHSA-2026:53799
- https://access.redhat.com/errata/RHSA-2026:53661
- https://access.redhat.com/errata/RHSA-2026:53835
- https://access.redhat.com/errata/RHSA-2026:53736
- https://access.redhat.com/errata/RHSA-2026:53778
- https://access.redhat.com/errata/RHSA-2026:53752
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:15091
- https://access.redhat.com/errata/RHSA-2026:14774
- https://access.redhat.com/errata/RHSA-2026:10104
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17474
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:8499
- https://access.redhat.com/errata/RHSA-2026:8500
- https://access.redhat.com/errata/RHSA-2026:8501
- https://access.redhat.com/errata/RHSA-2026:10172
- https://access.redhat.com/errata/RHSA-2026:10153
- https://access.redhat.com/errata/RHSA-2026:13571
- +4 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | GitHub_M |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat-SADP |
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Advisories
- GHSA-fvcv-3m26-pcqx — Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
European references
- ENISA EUVD · EUVD-2026-21573
- GCVE · GCVE-0-2026-40175
CERT-FR advisories
- CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1256 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0934 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0810 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0773 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0698 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0667 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0641 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0550 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*< 0.31.0cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*≥ 1.0.0 < 1.15.0
Affected products
| Product | Versions |
|---|---|
| axios · axios | affected >= 1.0.0, < 1.15.0 ; affected < 0.31.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |