CVE-2026-40175
Published: 10 April 2026
Summary
CVE-2026-40175 is a medium-severity HTTP Request/Response Splitting (CWE-113) vulnerability in Axios Axios. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely flaw remediation by patching Axios to versions 1.15.0 or 0.3.1, directly eliminating the prototype pollution gadget chain leading to RCE.
Requires vulnerability scanning of software dependencies to identify and prioritize the critical Axios vulnerability (CVE-2026-40175) for remediation.
Maintains an inventory of system components including third-party libraries like Axios, enabling identification and management of vulnerable versions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote, unauthenticated exploitation of a widely used HTTP client library (Axios) in web applications or Node.js environments, leading to RCE via prototype pollution gadget chains, directly mapping to Exploit Public-Facing Application.
NVD Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into…
more
Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.
Deeper analysisAI
CVE-2026-40175 affects the Axios library, a promise-based HTTP client used in browsers and Node.js environments, in versions prior to 1.15.0. The vulnerability enables a specific "Gadget" attack chain that escalates Prototype Pollution occurring in any third-party dependency into Remote Code Execution (RCE) or Full Cloud Compromise, including via AWS IMDSv2 bypass. It is associated with CWEs-113, CWE-444, and CWE-918, and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity.
Remote attackers with network access can exploit this vulnerability with low complexity, no required privileges, and no user interaction. By leveraging Prototype Pollution in a third-party dependency, they can chain it through Axios to achieve RCE on the target system or full compromise of cloud environments, such as bypassing AWS IMDSv2 protections.
The vulnerability is addressed in Axios version 1.15.0. Mitigation involves updating to this patched release, as detailed in the official GitHub security advisory (GHSA-fvcv-3m26-pcqx), the release notes for v1.15.0, and the fixing commit and pull request.
Details
- CWE(s)