REDHAT-BUG-2457432: High severity npm/axios vulnerability
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.15.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457432?
The severity of REDHAT-BUG-2457432 is high with a score of 7.
How do I fix REDHAT-BUG-2457432?
To fix REDHAT-BUG-2457432, upgrade the Axios library to version 1.15.0 or higher.
What kind of attack does REDHAT-BUG-2457432 facilitate?
REDHAT-BUG-2457432 facilitates a Gadget attack chain that can lead to Prototype Pollution and Remote Code Execution.
Which software is affected by REDHAT-BUG-2457432?
The affected software for REDHAT-BUG-2457432 is the npm package Axios.
When was REDHAT-BUG-2457432 published?
REDHAT-BUG-2457432 was published on April 10, 2026.