EUVD-2026-21573
GHSA-fvcv-3m26-pcqx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTTP request with prototype pollution payload
-
ExploitAxios processes request triggering gadget chain
-
ExecutionEscalate pollution to RCE via dependency chain
-
ImpactExecute arbitrary code or bypass AWS IMDSv2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization HTTP response header sanitization
|
| Exploitation Conditions | Remote unauthenticated attacker can exploit Axios versions prior to 1.15.0 when the application processes untrusted HTTP responses or data containing gadget chains. No user interaction required. Affects Node.js and browser environments using vulnerable Axios library versions. |
| Impact | CVSS 10.0 with unauthenticated network attack vector reflects critical severity: prototype pollution escalation to RCE or AWS credential theft via IMDSv2 bypass affects any Node.js application using vulnerable Axios versions. Widespread dependency chain exposure in JavaScript ecosystem amplifies blast radius. Urgent patching required for all affected versions below 1.15.0. |
| Exploit ScenarioDerived | Attacker crafts malicious HTTP response containing gadget chain payload. Vulnerable Axios version deserializes response, triggering prototype pollution. Pollution escalates to RCE execution or AWS IMDSv2 bypass for credential exfiltration. No authentication required; network-accessible services at risk. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Remote code execution affects Axios HTTP client library versions prior to 1.15.0 via gadget chain escalation of prototype pollution vulnerabilities in third-party dependencies. Unauthenticated network attackers can exploit this chaining mechanism to achieve full remote code execution or cloud compromise through AWS IMDSv2 bypass. Critical severity (CVSS 10.0) with scope change indicates containment boundary violation. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Upgrade to Axios version 1.15.0 or later immediately. Security fix implemented in commit 363185461b90b1b78845dc8a99a1f103d9b122a1 and merged via pull request 10660. Review all third-party dependencies for prototype pollution vulnerabilities (CWE-1321) as this attack requires pre-existing pollution gadgets in the dependency chain. For environments unable to upgrade immediately, implement strict input validation on all HTTP request parameters and consider network segmentation to prevent IMDS access. Full advisory and release notes: https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx and https://github.com/axios/axios/releases/tag/v1.15.0. Prioritize remediation given critical severity and chaining potential with ecosystem-wide prototype pollution issues.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-113 (Improper Neutralization of CRLF Sequences) enables gadget chain construction linking third-party prototype pollution vulnerabilities to RCE via Axios request processing mechanisms. Exploitation leverages AWS Instance Metadata Service v2 bypass techniques when Axios processes attacker-controlled HTTP headers in Node.js environments, achieving privilege escalation from object property manipulation to code execution.
Know when Axios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0.
Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
Executive ViewAI
Axios HTTP client library versions before 1.15.0 contain a critical remote code execution vulnerability (CVSS 10.0) exploitable by unauthenticated network attackers, potentially enabling full system compromise or cloud credential theft through AWS metadata service bypass. Any application using affected Axios versions faces immediate risk of code execution and lateral movement to cloud infrastructure. This requires emergency patching or architecture changes across all affected systems within 24 hours.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network egress from systems running affected Axios versions to known-safe endpoints only; (2) Enforce AWS IMDSv2 enforcement and disable IMDSv1 on all EC2 instances to prevent metadata service bypass; (3) Implement Web Application Firewall (WAF) rules to detect and block prototype pollution attack patterns; (4) Isolate affected services behind authentication proxies requiring mutual TLS; (5) Monitor for suspicious HTTP client behavior and cloud credential access anomalies. These controls reduce but do not eliminate risk-upgrade to Axios 1.15.0+ is mandatory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
Exploit-DB