What is the CVSS score of CVE-2026-40175?

CVE-2026-40175 has a contested CVSS base score of 4.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Node.js are affected by CVE-2026-40175?

Axios HTTP client library versions before 1.15.0 contain a critical remote code execution vulnerability (CVSS 10.0) exploitable by unauthenticated network attackers, potentially enabling full system…. A patch is available.

How to fix or mitigate CVE-2026-40175?

Within 24 hours: Inventory all applications and dependencies using Axios versions prior to 1.15.0 across development, staging, and production environments. Within 7 days: Upgrade Axios to version 1.15.0 or later on all systems; if upgrade is blocked by compatibility issues, implement network segmentation to restrict HTTP client access and disable AWS IMDSv2 fallback by enforcing IMDSv2-only enforcement. Within 30 days: Conduct full code review of custom HTTP clients and transitive dependencies; implement Software Composition Analysis (SCA) tooling to detect future high-risk library updates automatically.

Node.js CVE-2026-40175

EUVD-2026-21573 MEDIUM

HTTP Response Splitting (CWE-113)

2026-04-10 GitHub_M

GHSA-fvcv-3m26-pcqx

RCE Node.js Axios

Medium

Disputed · 4.8 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Red Hat

9.0 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 16, 2026 - 19:22 NVD

CRITICAL MEDIUM

CVSS changed

Apr 16, 2026 - 19:22 NVD

10.0 (CRITICAL) 4.8 (MEDIUM)

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21573

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

CVE Published

Apr 10, 2026 - 19:23 nvd

CRITICAL 10.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionNVD

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0.

AnalysisAI

Remote code execution affects Axios HTTP client library versions prior to 1.15.0 via gadget chain escalation of prototype pollution vulnerabilities in third-party dependencies. Unauthenticated network attackers can exploit this chaining mechanism to achieve full remote code execution or cloud compromise through AWS IMDSv2 bypass. Critical severity (CVSS 10.0) with scope change indicates containment boundary violation. No public exploit identified at time of analysis.

Technical ContextAI

CWE-113 (Improper Neutralization of CRLF Sequences) enables gadget chain construction linking third-party prototype pollution vulnerabilities to RCE via Axios request processing mechanisms. Exploitation leverages AWS Instance Metadata Service v2 bypass techniques when Axios processes attacker-controlled HTTP headers in Node.js environments, achieving privilege escalation from object property manipulation to code execution.

RemediationAI

Vendor-released patch: Upgrade to Axios version 1.15.0 or later immediately. Security fix implemented in commit 363185461b90b1b78845dc8a99a1f103d9b122a1 and merged via pull request 10660. Review all third-party dependencies for prototype pollution vulnerabilities (CWE-1321) as this attack requires pre-existing pollution gadgets in the dependency chain. For environments unable to upgrade immediately, implement strict input validation on all HTTP request parameters and consider network segmentation to prevent IMDS access. Full advisory and release notes: https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx and https://github.com/axios/axios/releases/tag/v1.15.0. Prioritize remediation given critical severity and chaining potential with ecosystem-wide prototype pollution issues.