Prototype Pollution and Remote Code Execution Vulnerability in Axios HTTP Client

CVE-2026-40175

What is CVE-2026-40175?

The Axios library, a popular promise-based HTTP client used in web applications and Node.js, has a significant vulnerability that enables a 'Gadget' attack chain. This flaw allows Prototype Pollution to exploit third-party dependencies, leading to potential Remote Code Execution (RCE). Attackers may further jeopardize the security of cloud environments by bypassing AWS IMDSv2 protections. Users are advised to upgrade to Axios version 1.15.0 or later to mitigate this risk.

References