Vulnerability intelligence

CVE-2026-40175

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

CVSS Score

4.8

Medium

EPSS — Exploit Probability

1.9%

Riskier than 77% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered May 14, 2026 · latest May 14, 2026

Coverage timeline

Siemens gWAP hit by RCE flaw via Axios library, patch now advised
www.cisa.gov · May 14, 2026