Read the docs
TI-2026-28989 Aliases CVE-2026-40175GHSA-fvcv-3m26-pcqx

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Priority MEDIUM 57CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 40 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01979 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.15.0, 0.31.0axios (npm): 1.15.0, 0.31.0Red Hat: 43 advisoriesRed Hat: 40 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.0.0 to before 1.15.0; before 0.31.01.15.0, 0.31.0Patch availableCNA
—axios (npm)1.0.0 to before 1.15.01.15.0Patch availableGHSA-fvcv-3m26-pcqx
—axios (npm)before 0.31.00.31.0Patch availableGHSA-fvcv-3m26-pcqx
  • axios Vendoraxios Affected 1.0.0 to before 1.15.0; before 0.31.0 Fixed in 1.15.0, 0.31.0 Patch available CNA
  • axios (npm) Vendor— Affected 1.0.0 to before 1.15.0 Fixed in 1.15.0 Patch available GHSA-fvcv-3m26-pcqx
  • axios (npm) Vendor— Affected before 0.31.0 Fixed in 0.31.0 Patch available GHSA-fvcv-3m26-pcqx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*before 0.31.0; 1.0.0 to before 1.15.0Vulnerableaxios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions before 0.31.0; 1.0.0 to before 1.15.0 Vulnerable ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.15.0, 0.31.0
  • Fix · GHSA-fvcv-3m26-pcqx axios (npm) Fixed in 1.15.0 Advisory →
  • Fix · GHSA-fvcv-3m26-pcqx axios (npm) Fixed in 0.31.0 Advisory →

Red Hat 43 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:53840 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.15 Images
    • Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53835 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.18 Images
    • Red Hat Container Native Virtualization 4.18 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
Show 40 more Red Hat advisories
  • RHSA-2026:53799 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.16 Images
    • Red Hat Container Native Virtualization 4.16 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53789 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53778 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.20 Images
    • Red Hat Container Native Virtualization 4.20 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53752 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.21 Images
    • Red Hat Container Native Virtualization 4.21 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53736 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.19 Images
    • Red Hat Container Native Virtualization 4.19 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53735 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53676 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.12 Images
    • Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin
  • RHSA-2026:53661 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:25041 Released 2026-06-10 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
  • RHSA-2026:24762 Released 2026-06-09 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click-8.3.3-1.el10ap, receptor-1.6.5-1.el10ap, receptorctl-1.6.5-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.12-1.el9ap, automation-controller-cli-4.7.12-1.el9ap, automation-controller-server-4.7.12-1.el9ap +10
  • RHSA-2026:20041 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:20938 Released 2026-05-26 · Red Hat rating Important
    RHACS 4.9.7 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:17468 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +14
  • RHSA-2026:17474 Released 2026-05-19 · Red Hat rating Important
    OpenShift Container Platform 4.21.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9 +13
  • RHSA-2026:17699 Released 2026-05-14 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.6 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/console-mce-rhel9
  • RHSA-2026:17657 Released 2026-05-14 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.11 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/console-mce-rhel9
  • RHSA-2026:14774 Released 2026-05-13 · Red Hat rating Important
    OpenShift Container Platform 4.15.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2026:16874 Released 2026-05-13 · Red Hat rating Important
    Network Observability 1.11.2 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +1
  • RHSA-2026:15091 Released 2026-05-12 · Red Hat rating Important
    OpenShift Container Platform 4.14.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:14937 Released 2026-05-07 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:13571 Released 2026-05-04 · Red Hat rating Critical
    Streams for Apache Kafka 3.2.0 release and security update
    • Streams for Apache Kafka 3.2.0
  • RHSA-2026:13548 Released 2026-05-04 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.2 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +8
  • RHSA-2026:13542 Released 2026-05-04 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.2 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +1
  • RHSA-2026:10104 Released 2026-04-30 · Red Hat rating Important
    OpenShift Container Platform 4.16.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:11414 Released 2026-04-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.3 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
  • RHSA-2026:10175 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.1 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/devspaces-rhel9-operator +8
  • RHSA-2026:10172 Released 2026-04-23 · Red Hat rating Important
    RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
  • RHSA-2026:10153 Released 2026-04-23 · Red Hat rating Important
    RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-rhel9, registry.redhat.io/rhtas/rhtas-console-ui-rhel9
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:8501 Released 2026-04-16 · Red Hat rating Critical
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:8500 Released 2026-04-16 · Red Hat rating Critical
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:8499 Released 2026-04-16 · Red Hat rating Critical
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:8493 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8491 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8490 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8484 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8483 Released 2026-04-16 · Red Hat rating Critical
    Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Build of Podman Desktop - Tech PreviewAffectedNo fix planned: Will not fix
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:16874
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:13548
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:20938
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:24762
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Red Hat Container Native Virtualization 4.12Fixed RHSA-2026:53676
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:53735
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:53789
Red Hat Container Native Virtualization 4.15Fixed RHSA-2026:53840
Red Hat Container Native Virtualization 4.16Fixed RHSA-2026:53799
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:53661
Red Hat Container Native Virtualization 4.18Fixed RHSA-2026:53835
Red Hat Container Native Virtualization 4.19Fixed RHSA-2026:53736
Red Hat Container Native Virtualization 4.20Fixed RHSA-2026:53778
Red Hat Container Native Virtualization 4.21Fixed RHSA-2026:53752
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Discovery 2Fixed RHSA-2026:14937
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:25041
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:15091
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:14774
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:10104
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20041
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:17468
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:17474
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:10175
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2026:8483
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:8484
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:8490
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:8491
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:8493
Red Hat Satellite 6.18Fixed RHSA-2026:8499, RHSA-2026:8500, RHSA-2026:8501
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:10153, RHSA-2026:10172
Streams for Apache Kafka 3.2.0Fixed RHSA-2026:13571
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:13542
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:17657
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:17699
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:11414
Not affected: 41 products
  • Cryostat 4
  • Gatekeeper 3
  • Logging Subsystem for Red Hat OpenShift
  • Network Observability (NETOBSERV) 1.11.0
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Build of Kueue
  • Red Hat Ceph Storage 9.2
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Trusted Artifact Signer 1.3
  • Self-service automation portal 2
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40175
  2. 2026-10-03 Alias added: GHSA-fvcv-3m26-pcqx
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  5. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 5

Advisory 1

Other 4

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
  • TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
  • TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
  • TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences