Axios: Critical Axios Vulnerability Allows Remote Code Execution – PoC Exploit Released

Critical Axios Vulnerability (CVE-2026-40175) Enables Cloud Infrastructure Compromise

A newly disclosed critical vulnerability in the widely used Axios HTTP client library (CVE-2026-40175, CVSS 9.9) exposes web applications and cloud environments to Remote Code Execution (RCE) and full infrastructure takeover. The flaw, discovered by security researcher Raulvdv and later detailed by Jasonsaayman, allows attackers to bypass AWS IMDSv2 protections, exfiltrate sensitive metadata, and steal credentials.

The vulnerability stems from unrestricted header processing and missing input sanitization in Axios’s lib/adapters/http.js file. When combined with Server-Side Request Forgery (SSRF) and HTTP Request Smuggling, it forms a high-risk "Gadget Attack Chain" that requires no user interaction. Exploitation occurs via JavaScript prototype pollution, where tainted properties from dependencies (e.g., body-parser, qs, minimist) are merged into Axios’s request configuration. The lack of CRLF (carriage return/line feed) sanitization enables attackers to inject malicious headers, hijacking outbound requests.

A public Proof of Concept (PoC) demonstrates how attackers can abuse this flaw to craft a PUT request to AWS EC2 Metadata Service (169.254.169.254), bypassing IMDSv2 token requirements. Successful exploitation grants access to IAM session tokens, privilege escalation, and full cloud environment control. Additional risks include authentication bypass, cache poisoning, and RCE in containerized/serverless systems.

All Axios versions before 1.13.2 are vulnerable. The patched version (1.15.0+) enforces strict header validation, blocking prototype pollution-based attacks. Organizations are urged to upgrade immediately and audit dependencies for prototype pollution vectors.

Source: https://cyberpress.org/axios-vulnerability-3/

Axios cybersecurity rating report: https://www.rankiteo.com/company/axios

"id": "AXI1776083164",
"linkid": "axios",
"type": "Vulnerability",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'type': 'Organizations using Axios versions before '
                                '1.13.2'}],
 'attack_vector': ['Server-Side Request Forgery (SSRF)',
                   'HTTP Request Smuggling',
                   'JavaScript Prototype Pollution'],
 'data_breach': {'data_exfiltration': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['IAM session tokens',
                                              'Sensitive metadata']},
 'description': 'A newly disclosed critical vulnerability in the widely used '
                'Axios HTTP client library (CVE-2026-40175, CVSS 9.9) exposes '
                'web applications and cloud environments to Remote Code '
                'Execution (RCE) and full infrastructure takeover. The flaw '
                'allows attackers to bypass AWS IMDSv2 protections, exfiltrate '
                'sensitive metadata, and steal credentials. The vulnerability '
                'stems from unrestricted header processing and missing input '
                'sanitization in Axios’s lib/adapters/http.js file. When '
                'combined with Server-Side Request Forgery (SSRF) and HTTP '
                "Request Smuggling, it forms a high-risk 'Gadget Attack Chain' "
                'that requires no user interaction. Exploitation occurs via '
                'JavaScript prototype pollution, enabling attackers to inject '
                'malicious headers and hijack outbound requests.',
 'impact': {'data_compromised': ['IAM session tokens', 'Sensitive metadata'],
            'operational_impact': 'Full cloud environment control',
            'systems_affected': ['Web applications',
                                 'Cloud environments',
                                 'Containerized/serverless systems']},
 'post_incident_analysis': {'corrective_actions': ['Strict header validation',
                                                   'Dependency audits'],
                            'root_causes': ['Unrestricted header processing',
                                            'Missing input sanitization',
                                            'JavaScript prototype pollution']},
 'recommendations': ['Upgrade to Axios version 1.15.0+',
                     'Audit dependencies for prototype pollution vectors'],
 'references': [{'source': 'Raulvdv (Security Researcher)'},
                {'source': 'Jasonsaayman'},
                {'source': 'Proof of Concept (PoC)'}],
 'response': {'containment_measures': 'Upgrade to Axios version 1.15.0+',
              'remediation_measures': ['Enforce strict header validation',
                                       'Audit dependencies for prototype '
                                       'pollution vectors']},
 'title': 'Critical Axios Vulnerability (CVE-2026-40175) Enables Cloud '
          'Infrastructure Compromise',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-40175'}