Axios prototype-pollution header injection gadget chain
CVE-2026-40175 is a vulnerability in Axios, the promise-based HTTP client for Node.js and browsers. In affected versions prior to 1.15.0 and 0.3.1, Axios can act as a gadget in a broader attack chain: if an attacker first achieves prototype pollution through another vulnerable dependency, polluted Object.prototype properties may be merged into Axios request configuration and emitted as outbound HTTP header values without proper CRLF neutralization. The issue is described in the provided content as residing in Axios header processing, including lib/adapters/http.js, where merged header values were not sufficiently sanitized before request construction. This can turn prototype pollution into header injection and, depending on environment and request path, enable follow-on abuse such as HTTP request smuggling and SSRF against internal services or cloud metadata endpoints.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a self-contained JavaScript PoC environment for CVE-2026-40175, described as an Axios CRLF injection issue in vulnerable Axios versions. It is not a framework module; it is a standalone exploit lab built around Node.js, Docker, nginx, and a mock AWS IMDSv2 service. Structure and purpose: - README.md explains the vulnerability, attack chain, prerequisites, and test scenarios. - docker-compose.yml plus Dockerfile.backend and Dockerfile.imds build a multi-container lab with three services: backend, nginx, and a mock IMDS service. - poc/backend-server.js provides a backend HTTP server on port 3001 that logs requests and exposes /last-request, plus a static server on port 3003 for the browser PoC. - poc/nginx-container.conf configures nginx as an intentionally unsafe open proxy using proxy_pass http://$http_host with resolver 127.0.0.11 and ignore_invalid_headers on, which is central to the SSRF demonstration. - poc/mock-imds.js simulates AWS IMDSv2, including token issuance and fake credential retrieval. - poc/test-axios-adapter-backend.js and poc/test-axios-adapter-nginx.js are Node-based PoCs that use a custom rawSocketAdapter built on net.Socket to bypass normal Node HTTP header validation and send raw HTTP containing CRLF-injected headers. - poc/test-axios-no-adapter.js demonstrates that standard Axios/Node behavior blocks the attack path without the custom adapter. - poc/test-prototype-pollution.js demonstrates a full chain: vulnerable recursive merge -> Object.prototype pollution -> inherited headers -> Axios header serialization -> raw socket transmission -> nginx routing -> SSRF to IMDS. - poc/exploit.html is a browser-facing demonstration comparing standard XHR behavior versus a custom adapter/relay concept; it loads axios 1.14.0 from jsDelivr and is intended to visualize success/failure paths. Main exploit capabilities: 1. CRLF header injection into Axios-managed headers. 2. Construction of raw HTTP requests that preserve embedded CRLF sequences. 3. HTTP request smuggling by appending a second request after the injected header block. 4. SSRF through nginx by controlling the Host header used in proxy_pass http://$http_host. 5. Access to internal metadata-style endpoints, specifically a mock IMDSv2 token endpoint and credential endpoint. 6. Demonstration of prototype pollution as an upstream primitive for injecting malicious headers into Axios configuration. Notable observations: - The exploit is operational rather than merely theoretical because it includes working code for raw socket transmission and a complete lab environment. - The repository is educational and intentionally uses a mock IMDS service with fake credentials rather than real cloud targets. - package.json references scripts for poc/vulnerable-app.js and poc/exploit.js, but those files are not present in the provided file list; the actual usable entry points are the test scripts under poc/. - The browser PoC references a relay on port 3004 in the README/UI, but the shown backend-server.js only implements ports 3001 and 3003; relay functionality may be incomplete or omitted from the provided content.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical-severity vulnerability in Axios affecting third-party dependencies used in Atlassian products.
A library-level Axios gadget-chain issue in which polluted prototype values could be incorporated into headers, theoretically enabling CRLF header injection, request smuggling/SSRF, and possible AWS metadata access. However, the content states standard Node.js, Bun, and Deno runtimes block the required malformed headers, making real-world exploitation in typical environments not realistically achievable.
A critical Axios header processing vulnerability that can enable request smuggling, cloud metadata exfiltration, IAM credential theft, privilege escalation, and potential cloud account takeover when combined with prototype pollution in a dependency.
A critical vulnerability in the Axios HTTP client library involving improper header handling that can be chained with prototype pollution, SSRF, and HTTP request smuggling to bypass AWS IMDSv2 protections, exfiltrate cloud metadata/credentials, and potentially lead to full infrastructure compromise.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.