CVE-2026-40175

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-40175) has been identified in Axios's handling of outbound HTTP headers. When a separate vulnerability has already polluted the JavaScript prototype, attacker-controlled values may enter request headers without adequate sanitization. Values containing carriage-return and line-feed (CRLF) characters can potentially alter HTTP message boundaries, enabling request splitting or smuggling under susceptible transport and intermediary conditions.

This failure to sanitize header values maps to CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). The CVE also identifies CWE-444 (HTTP Request/Response Smuggling) and CWE-918 (Server-Side Request Forgery), reflecting potential consequences when manipulated requests are interpreted inconsistently or directed to unintended services. Exploitation requires an existing prototype pollution flaw and an environment that permits the injected headers to affect request processing.

Details

Module Info

Product: Axios
Affected packages: axios
Affected versions:

• >=1.0.0, <1.15.0
• <0.31.0

GitHub repository: https://github.com/axios/axios
Published packages: https://www.npmjs.com/package/axios
Package manager: npm

• Fixed in:
  • OSS Axios v1.15.0
  • OSS Axios v0.31.0
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability concerns Axios's outbound header processing when another component has already polluted Object.prototype. Malicious inherited values can become part of request headers, creating an opportunity for CRLF injection. The current Axios advisory severity panel assigns a CVSS v3.1 score of 4.8.

An attacker able to introduce suitable polluted values could potentially manipulate HTTP request boundaries. In a susceptible deployment, this may enable request smuggling or access to internal services, including cloud metadata endpoints. Such outcomes depend on the transport, intermediary behavior, network access, and existing prototype pollution; cloud credential theft is not an automatic consequence.

This behavior aligns with CWE-113, CWE-444, and CWE-918. These classifications describe a chain in which unsafe header content can change message interpretation and enable unintended server-side requests, potentially compromising data confidentiality or request integrity.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.