# CVE-2026-40175: Axios header injection via prototype pollution gadget

Source: https://junglewise.ai/threats/cve-2026-40175-axios-header-injection-via-prototype-pollution-gadget  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-40175 · Severity: high · CVSS 4.8 · Published 2026-04-10

Axios, a widely used tool for making web requests in JavaScript applications, is vulnerable to a security flaw that could allow attackers to manipulate web traffic. By exploiting a weakness in how Axios handles data from other components, an attacker could potentially steal sensitive cloud credentials or gain unauthorized access to internal systems. This could lead to a full compromise of cloud environments like AWS or the execution of malicious code on the server.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios), [axios (npm)](https://junglewise.ai/threats/technologies/npm-axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios), [npm](https://junglewise.ai/threats/vendors/npm), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-40175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40175 being exploited in the wild.

**How severe is CVE-2026-40175?** High severity, with a CVSS score of 4.8, published 10 April 2026.

**Which products and versions are affected?** Axios < 1.15.0, < 0.31.0, >= 1.0.0, < 1.15.0; < 0.31.0; axios (npm) SEMVER:introduced=1.0.0,fixed=1.15.0; Siemens gPROMS Web Applications Publisher < 3.1.1.

**Is there a fix for CVE-2026-40175?** Yes. axios (npm): upgrade to 1.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40175 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40175?** Check whether you run Axios, axios (npm) or Siemens gPROMS Web Applications Publisher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- axios (npm): upgrade to 1.15.0 or later

  ```sh
  npm install axios@1.15.0
  ```


## Technical details

Axios versions prior to 1.15.0 and 0.31.0 are vulnerable to a 'gadget' attack chain. The vulnerability occurs when prototype pollution in a third-party dependency is used to inject unsanitized header values into outbound HTTP requests. This can be escalated to achieve Server-Side Request Forgery (SSRF), specifically bypassing AWS IMDSv2 protections to exfiltrate cloud metadata, or potentially achieving Remote Code Execution (RCE). The attack requires a precondition of a prototype pollution vulnerability existing elsewhere in the application's dependency tree. Patches are available in versions 1.15.0 and 0.31.0.

## Affected products

- Axios Axios < 1.15.0, < 0.31.0

## Identifiers

- CVE-2026-40175
- GHSA-fvcv-3m26-pcqx

## Timeline

- 2026-04-10: advisory: Initial publication date
- 2026-04-06: patched: Fix for cloud metadata exfiltration committed
- 2026-04-11: patched: Backported fixes committed to v0.x branch

## References

- [https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c](https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c)
- [https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1](https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1)
- [https://github.com/axios/axios/pull/10660](https://github.com/axios/axios/pull/10660)
- [https://github.com/axios/axios/pull/10688](https://github.com/axios/axios/pull/10688)
- [https://github.com/axios/axios/releases/tag/v0.31.0](https://github.com/axios/axios/releases/tag/v0.31.0)
- [https://github.com/axios/axios/releases/tag/v1.15.0](https://github.com/axios/axios/releases/tag/v1.15.0)
- [https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx](https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)