CVE-2026-40175 — Axios is a promise based HTTP client for the browser and Node.js. Prior to…

/HIGH
CVE Notify vulnerabilitycvecloud
CVE-2026-40175 — Axios is a promise based HTTP client for the browser and Node.js. Prior to…

🚨 CVE-2026-40175 Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compro

fix: unrestricted cloud metadata exfiltration via header injection ch… · axios/axios@3631854
github.com

What This Means For You

  • Affects Apple ecosystem — update macOS/iOS devices.
  • New vulnerability disclosed — verify if your stack is exposed.
  • Supply chain risk — audit dependencies and third-party integrations.

Related ATT&CK Techniques

T1505.003 Server Software Component Initial Access T1059.001 PowerShell Execution T1204.002 Malicious File Execution

Indicators of Compromise

IDTypeIndicator
CVE-2026-40175 Vulnerability CVE-2026-40175
🔎
Get the full picture on this threat Use /org to search affected organizations, generate IOC briefs with /brief, and set watchlist alerts — inside Telegram.
Try Intel Bot →
Source & Attribution
Source PlatformTelegram
ChannelCVE Notify
Channel ID1129491012
Message ID158855
PublishedApril 10, 2026 at 23:27 UTC
Original Linkhttps://github.com/axios/axios/commit/363185461b90b1b7884...

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.