CVE-2026-40175

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Affected products

Axios, Confluence

Axios

< 0.31.0, 1.15.0

Fix

Available

CVSS 3.1

9.0 CRITICAL

EPSS

1.9% (77th percentile)

Weakness

CWE-918, CWE-113, CWE-444, CWE-915

NVD status

Modified

Published

2026-04-10