Axios CVE-2026-40175: A Critical Rating That Tells Half the Story
A look at CVE-2026-40175 in Axios — a real vulnerability at the library level, but one that Node.js mitigates in typical environments.
Axios has had a rough couple of weeks. First came a supply chain scare, and then a newly published CVE hit the headlines with a critical 9.9 severity rating and claims of full cloud compromise. Stolen AWS credentials, IMDSv2 bypass, remote code execution chains... Naturally, the security community took notice.
But when you trace the exploit path through a real Node.js environment, the story looks quite different.
What Happened
Security researcher Raul Vega Del Valle discovered that Axios does not sanitize HTTP header values for CRLF characters. On its own that might not sound dramatic, but the advisory describes a multi-step "gadget chain" that could, in theory, escalate a prototype pollution vulnerability in another dependency into a full server-side request forgery attack.
The chain works like this: a polluted prototype injects a malformed header value into an Axios request, the CRLF characters manipulate how the request is interpreted, and that confusion can be leveraged to target internal services such as the AWS metadata endpoint. On paper, it is a devastating sequence.
The Problem
The core issue is straightforward. Axios merges configuration objects without checking whether header values contain carriage return or line feed characters. If those characters slip through, the outgoing HTTP request may be interpreted in unintended ways, opening the door to request smuggling and SSRF.
At the library level, this is a genuine flaw. Axios should reject these characters regardless of what the runtime does.
Why It Is Less Scary in Practice
Here is where context matters. Axios sends requests through Node's built-in http.request, and Node.js has blocked CRLF characters in header values for years. Any attempt to pass a header containing \r\n will throw a TypeError before the request is sent.
This effectively breaks the exploit chain in standard environments. The injected header never reaches the network layer.
The same protection exists in other modern runtimes like Bun and Deno. Even the researcher noted that in typical real-world setups, the CRLF injection does not succeed.
That said, this protection is contextual, not absolute.
If an application uses a custom Axios adapter that bypasses Node's HTTP client, or runs in an environment with different HTTP handling behavior, the underlying issue can still become exploitable. Similarly, relying on runtime validation instead of enforcing constraints at the library boundary creates fragile security guarantees.
The Solution
The Axios team patched the issue by adding header value validation directly in the library. Upgrading to Axios 1.15.0 or later resolves the vulnerability.
Even if your runtime already blocks the exploit, upgrading is still the correct move. Security should not depend on indirect protections that may change across environments or over time.
It is also worth auditing your dependencies for prototype pollution risks and reviewing whether your services have unnecessary access to internal metadata endpoints.
Why This Matters
This vulnerability is a good example of why CVSS scores and advisory headlines only tell part of the story.
At the library level, the issue is real and correctly identified. But its real-world impact depends heavily on the execution environment. Evaluating vulnerabilities without that context can lead to both overreaction and misplaced priorities.
At the same time, dismissing issues because “the runtime blocks it” misses the broader lesson: libraries should enforce their own security boundaries, not rely on downstream safeguards.