UpHeron
All vulnerabilities

npm

CVE-2026-40175

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Severity
Medium 4.8
Published
10 Apr 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
0.31.0, 1.15.0
Also known as
GHSA-fvcv-3m26-pcqx
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
axiosnpm · osv:npm:axios
  • Every version before 0.31.0
  • From 1.0.0 before 1.15.0

References