axios package vulnerabilities: CVE-2026-42043, CVE-2026-42044, CVE-2026-40175 and CVE-62718

🗓️ 22 Sep 2026 00:00:00Reported by Broadcom Security ResponseType

broadcom🔗 support.broadcom.com👁 19 Views

Axios prior to 1.15.0/0.31.0 allows SSRF via NO_PROXY bypass and header injection.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (2025-62718)	28 May 202615:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rhapsody Systems Engineering is vulnerable to prototype pollution abuse	28 Jul 202614:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Axios and Netty might affect IBM Storage Defender Copy Data Management	30 Sep 202617:05	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	5 May 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities	25 Sep 202619:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.	14 Jul 202611:48	–	ibm
IBM Security Bulletins	Security Bulletin: Langflow OSS affected by vulnerabilies in Axios versions prior to 1.15.0	8 Jun 202618:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in axios, follow-redirects, fast-uri and babel might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	27 Jun 202615:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	2 Jun 202614:29	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in Axios	20 May 202615:08	–	ibm

22 Sep 2026 20:29Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.2 - 10

CVSS 46.3

EPSS0.01307

SSVC

Axios SSRF NO_PROXY bypass prototype pollution header injection request smuggling