Critical Axios Flaw Enables Request Smuggling, IMDSv2 Bypass, and Cloud Compromise

A critical vulnerability in the Axios HTTP client library, tracked as CVE-2026-40175, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for SSRF, request smuggling, and potential remote code execution. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let Object.prototype values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at 169.254.169.254, potentially bypassing IMDSv2 and exposing cloud credentials or broader infrastructure.

A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before 1.13.2, while maintainers said 1.15.0 introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as body-parser, qs, and minimist for prototype pollution paths. One report cited internet-wide estimates of more than 48,000 potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.