Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Title source: cnaExploitation Summary
EIP tracks 5 public exploits for CVE-2026-40175. PoCs published by adminlove520, pjt3591oo, LeeKangHyun.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-40175, demonstrating CRLF injection in Axios HTTP client leading to HTTP request smuggling and SSRF via nginx open proxy. It includes detailed technical analysis, exploit code, and a Docker-based test environment.
Description
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.
Exploits (5)
This repository contains a functional proof-of-concept for CVE-2026-40175, demonstrating CRLF injection in Axios HTTP client leading to HTTP request smuggling and SSRF via nginx open proxy. It includes detailed technical analysis, exploit code, and a Docker-based test environment.
This repository contains a functional proof-of-concept for CVE-2026-40175, demonstrating CRLF injection in Axios HTTP client leading to HTTP request smuggling and SSRF via nginx open proxy. It includes detailed technical analysis, root cause, and multiple test scenarios.
This repository provides a detailed technical analysis and mitigation guide for CVE-2026-40175, an Axios CRLF injection vulnerability leading to HTTP request smuggling and SSRF. It includes root cause analysis, patching strategies, and code examples for both source-level and runtime defenses.
This repository contains a Node.js-based scanner tool designed to detect vulnerable versions of the axios library (CVE-2026-40175) in local project directories. It provides interactive and automated patching capabilities but does not include exploit code for the vulnerability itself.
This repository provides a detailed technical analysis of CVE-2026-40175, a critical prototype pollution vulnerability in Axios versions prior to 1.15.0. It explains the escalation to RCE and cloud compromise, includes mitigation steps, and references official sources.
References (9)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N