Ignition 8.1 bundles the axios JavaScript HTTP client in the Gateway web pages, the Perspective client and the Perspective Designer. 8.1.49 ships axios 1.10.0. Web and dependency scanners fingerprint it and report every published axios CVE against it, currently about twenty, including CVE-2026-40175 (CVSS 10.0), CVE-2025-62718 (9.9), CVE-2026-42033, CVE-2026-42035, CVE-2026-42264, CVE-2026-44494, CVE-2026-44492 and the rest of the CVE-2026-420xx and CVE-2026-444xx series.
Inductive Automation has reviewed these against Ignition 8.1. Ignition ships axios only as browser-side JavaScript; it does not run axios under Node.js (see the Node.js post). Every CVE in this set is in axios’s Node.js HTTP adapter, its proxy and NO_PROXY handling, its multipart stream encoder or its HTTP/2 session code, or depends on another library having already polluted Object.prototype in the same Node.js process. None of those code paths execute in a browser, and the remaining browser-side items (XSRF token handling, URL encoding) still require a prototype pollution primitive that Ignition does not ship. No exploitation against Ignition has been demonstrated, and none of these CVEs is in CISA’s KEV catalog.
Inductive Automation is updating axios to 1.18.0 or later in Ignition 8.1.56 (early Dec) so that scanners stop flagging it. Ignition 8.3.10 already ships axios 1.19.0, which covers all CVEs above; 8.3.11 moves to 1.20.0 for a newer batch (CVE-2026-1018xx to 1019xx). No customer action is required in the meantime. Scanners are correct about the version and incorrect about exposure; if your organization needs a clean report before 8.1.56, the Ignition Security Hardening Guide (reverse proxy, network segmentation) does not change the scanner result but does reduce the Gateway’s exposure generally.