CVE-2026-40175: Axios Library Vulnerability Leading to Unrestricted Cloud Metadata Exfiltration
Summary
CVE-2026-40175: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain. Affects axios versions < 1.15.0. Fixed in 1.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. The library is widely adopted due to its promise-based architecture, ease of use, and ability to handle requests and responses seamlessly. However, it has a critical vulnerability that allows for unrestricted cloud metadata exfiltration due to improper header sanitization.
Vulnerability Detail
The Axios library is susceptible to a 'Gadget' attack chain that can escalate prototype pollution in third-party dependencies into Remote Code Execution (RCE) or Full Cloud Compromise through an AWS IMDSv2 bypass. This vulnerability arises from a lack of HTTP header sanitization, allowing attackers to inject malicious headers without direct user input. If an attacker can manipulate the Object.prototype via any library in the stack, Axios will merge these polluted properties into request headers, leading to potential request smuggling and unauthorized access to sensitive cloud metadata.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.0
This is the first release that contains the fix.
npm install axios@1.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that no third-party libraries that may pollute Object.prototype are used in conjunction with Axios. Additionally, you can manually sanitize header values before making requests to prevent injection of CRLF characters.
Conclusion
The Axios library's vulnerability (CVE-2026-40175) poses a significant risk due to its potential for remote code execution and cloud metadata exfiltration. It is crucial for developers to update to the patched version and implement proper header validation to mitigate this risk.
See every vulnerability recorded for axios →
FAQ
CVE-2026-40175 is a critical vulnerability in the Axios library that allows for unrestricted cloud metadata exfiltration due to improper header sanitization.
If your application uses Axios and is vulnerable, attackers can exploit this flaw to execute arbitrary code or access sensitive cloud metadata, potentially compromising your cloud environment.
All versions of Axios from v0.x to v1.x are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 10.0, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
