Brief Summary: Axios CVE-2026-40175 Prototype Pollution Gadget Chain to RCE and Cloud Compromise

Introduction

Axios is the most widely downloaded JavaScript HTTP client. Through a prototype pollution gadget chain in Axios, an attacker can escalate a seemingly benign property injection in any third-party dependency into full Remote Code Execution or cloud credential exfiltration, including an AWS IMDSv2 bypass. CVE-2026-40175 carries a CVSS score of 10.0. With approximately 100 million weekly npm downloads and over 174,000 dependent packages, Axios makes this a systemic risk to the JavaScript ecosystem, and it arrives while the project is already reeling from a nation-state supply chain compromise.

Technical Information

The root cause of CVE-2026-40175 is improper neutralization of CRLF (carriage return, line feed) sequences in HTTP headers, classified as CWE-113. The vulnerable code is in the header processing logic in lib/adapters/http.js and xhr.js.

The Gadget Chain Mechanism

Axios automatically merges configuration when it builds HTTP requests. The design is convenient for developers, but combined with prototype pollution it becomes a dangerous "gadget". The attack chain runs in four stages.

Stage 1: Prototype Pollution (External Trigger)

The attacker achieves prototype pollution through any vulnerable library in the application's dependency tree. Common candidates include qs, minimist, ini, and body-parser. The chain is ready once Object.prototype carries attacker-controlled properties that contain CRLF sequences.

Stage 2: CRLF Injection via Configuration Merge (CWE-113)

When Axios merges its request configuration, it picks up the polluted prototype properties as header values. Axios does not sanitize these merged values for carriage return (\r) and line feed (\n) characters, so the attacker's payload goes directly into the outgoing HTTP headers. That turns a prototype pollution primitive into a header injection primitive.

Stage 3: HTTP Request Smuggling (CWE-444)

The injected CRLF sequences let the attacker craft a request smuggling payload. The payload ends the original request headers and injects an entirely new HTTP request on the same connection. With it, the attacker can bypass intermediary security controls such as proxies, load balancers, and web application firewalls.

Stage 4: Server-Side Request Forgery and Cloud Compromise (CWE-918)

The attacker points the smuggled request at internal endpoints that are normally unreachable. The most damaging target is the cloud instance metadata service. This chain bypasses AWS IMDSv2 protections, which exist specifically to prevent SSRF-based credential theft. Successful exploitation returns temporary cloud credentials (IAM role credentials), and with those the attacker can compromise the full cloud account.

Vulnerability Component Mapping

The exploit needs zero direct user input. If any dependency in the application stack is vulnerable to prototype pollution, Axios silently becomes the escalation vector.

Temporary Mitigation Code

Where you cannot upgrade immediately, the official advisory suggests adding CRLF validation in the adapter layer:

utils.forEach(requestHeaders, function setRequestHeader(val, key) {
  if (/[\r\n]/.test(val)) {
    throw new Error('Security: Header value contains invalid characters');
  }
});

Apply this check in both lib/adapters/http.js and xhr.js, before header values reach the underlying request function.

Affected Systems and Versions

CVE-2026-40175 affects all versions of Axios before 1.15.0. Version 1.15.0 contains the fix.

Do not use versions 1.14.1 or 0.30.4 under any circumstances. A separate supply chain attack compromised both of them. The safe upgrade path goes directly to version 1.15.0.

Vendor Security History

The Axios project has recently been the target of a significant supply chain attack. On March 31, 2026, threat actors compromised the lead maintainer's npm account and published malicious versions 1.14.1 and 0.30.4. These versions included a phantom dependency called "plain crypto js". During installation it executed an obfuscated dropper, which deployed a cross-platform Remote Access Trojan known as WAVESHAPER.V2 on Windows, macOS, and Linux systems.

Microsoft Threat Intelligence and Google Threat Intelligence Group attributed this campaign to financially motivated North Korea-nexus actors tracked as UNC1069 and Sapphire Sleet. Axios now faces both a CVSS 10.0 gadget chain vulnerability and an active nation-state supply chain campaign, so any project that relies on it needs rigorous dependency management.

References

• NVD Entry for CVE-2026-40175
• GitHub Security Advisory GHSA-fvcv-3m26-pcqx: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
• Axios v1.15.0 Release Notes
• Fix Commit: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
• Pull Request #10660: Fix for Header Injection Chain
• Trend Micro: Axios NPM Package Compromised: Supply Chain Attack
• Google Cloud Blog: North Korea Nexus Threat Actor Compromises Widely Used Axios npm Package
• Microsoft Security Blog: Mitigating the Axios npm Supply Chain Compromise
• Elastic Security Labs: Inside the Axios Supply Chain Compromise
• Huntress: Supply Chain Compromise of axios npm Package
• Orca Security: Axios Supply Chain Attack Analysis and Fix