4.8
Medium
CVE-2026-40175 Axios is a promise based HTTP client for the browser and Node.js
Description
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| axios 1.0 | 1.0.0 → < 1.15.0 | 1.15.0 |
| axios 0.31 | earliest → < 0.31.0 | 0.31.0 |
| gWAP 3.1 | earliest → < 3.1.1 | 3.1.1 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Network Observability (NETOBSERV) 1.11.2 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126 | earliest → < 1776927126 | 1776927126 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat Developer Hub 1.8 1776784286 | earliest → < 1776784286 | 1776784286 |
| Red Hat Developer Hub 1.9 1777903262 | earliest → < 1777903262 | 1777903262 |
Show the 70 other branches Hide the 70 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Discovery 2 1778156756 | earliest → < 1778156756 | 1778156756 |
| Red Hat Migration Toolkit 1.8 1780590717 | earliest → < 1780590717 | 1780590717 |
| Red Hat OpenShift AI 3.3 1778666987 | earliest → < 1778666987 | 1778666987 |
| Red Hat OpenShift Container Platform 4.14 1777997704 | earliest → < 1777997704 | 1777997704 |
| Red Hat OpenShift Container Platform 4.15 1777994748 | earliest → < 1777994748 | 1777994748 |
| Red Hat OpenShift Container Platform 4.16 1776827996 | earliest → < 1776827996 | 1776827996 |
| Red Hat OpenShift Container Platform 4.19 1779249923 | earliest → < 1779249923 | 1779249923 |
| Red Hat OpenShift Container Platform 4.20 1778638503 | earliest → < 1778638503 | 1778638503 |
| Red Hat OpenShift Container Platform 4.21 1778539219 | earliest → < 1778539219 | 1778539219 |
| Red Hat OpenShift Dev Spaces 3.27 1776795511 | earliest → < 1776795511 | 1776795511 |
| Red Hat OpenShift Service Mesh 2.6 1776191302 | earliest → < 1776191302 | 1776191302 |
| Red Hat OpenShift Service Mesh 3.0 1776151272 | earliest → < 1776151272 | 1776151272 |
| Red Hat OpenShift Service Mesh 3.1 1776151270 | earliest → < 1776151270 | 1776151270 |
| Red Hat OpenShift Service Mesh 3.2 1776149682 | earliest → < 1776149682 | 1776149682 |
| Red Hat OpenShift Service Mesh 3.3 1776151277 | earliest → < 1776151277 | 1776151277 |
| Red Hat Satellite 6.18 1776269713 | earliest → < 1776269713 | 1776269713 |
| Red Hat Trusted Artifact Signer 1.3 1776778645 | earliest → < 1776778645 | 1776778645 |
| Red Hat Trusted Artifact Signer 1.3 1776672801 | earliest → < 1776672801 | 1776672801 |
| Streams for Apache Kafka 3.2.0 | Versions not published | |
| multicluster engine for Kubernetes 2.10 1777128790 | earliest → < 1777128790 | 1777128790 |
| multicluster engine for Kubernetes 2.6 1778511348 | earliest → < 1778511348 | 1778511348 |
| multicluster engine for Kubernetes 2.8 1778383863 | earliest → < 1778383863 | 1778383863 |
| multicluster engine for Kubernetes 2.9 1777301444 | earliest → < 1777301444 | 1777301444 |
| Migration Toolkit for Applications 8 | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Trusted Profile Analyzer | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Build of Kueue | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 | earliest → < 1783451729 | 1783451729 |
| Red Hat OpenShift Service Mesh 3 1776151272 | earliest → < 1776151272 | 1776151272 |
| Red Hat Advanced Cluster Security 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat Migration Toolkit for Containers 1.8 1780590717 | earliest → < 1780590717 | 1780590717 |
| Red Hat OpenShift Container Platform 4.2 1778638503 | earliest → < 1778638503 | 1778638503 |
| multicluster engine for Kubernetes 2.1 1777128790 | earliest → < 1777128790 | 1777128790 |
| multicluster engine for Kubernetes 2.9.0 1777301444 | earliest → < 1777301444 | 1777301444 |
| Network Observability (NETOBSERV) 1.11.1 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Container Native Virtualization 4.12 1786029653 | earliest → < 1786029653 | 1786029653 |
| Red Hat Container Native Virtualization 4.13 1786327570 | earliest → < 1786327570 | 1786327570 |
| Red Hat Container Native Virtualization 4.14 1786328211 | earliest → < 1786328211 | 1786328211 |
| Red Hat Container Native Virtualization 4.15 1786328346 | earliest → < 1786328346 | 1786328346 |
| Red Hat Container Native Virtualization 4.16 1786328683 | earliest → < 1786328683 | 1786328683 |
| Red Hat Container Native Virtualization 4.17 1786327616 | earliest → < 1786327616 | 1786327616 |
| Red Hat Container Native Virtualization 4.18 1786328550 | earliest → < 1786328550 | 1786328550 |
| Red Hat Container Native Virtualization 4.19 1785968159 | earliest → < 1785968159 | 1785968159 |
| Red Hat Container Native Virtualization 4.20 1786329530 | earliest → < 1786329530 | 1786329530 |
| Red Hat Container Native Virtualization 4.21 1786010898 | earliest → < 1786010898 | 1786010898 |
| Network Observability (NETOBSERV) 1.11.0 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Container Native Virtualization 4.2 1786329530 | earliest → < 1786329530 | 1786329530 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of axios
The 53 CVEs of axios →
CVE-2026-101899
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js
8.3
High
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js
7.0
High