Remote arbitrary code execution affecting Axios

Axios is a javascript library for easily making HTTP requests, both in the browser and in node.js applications. It is primarily used to communicate with APIs, simplifying sending and receiving data (often in JSON), error handling, query configuration, and authentication. It is one of the most used libraries, with 100 million downloads weekly. This solution is affected by a vulnerability labeled CVE-2026-40175 resulting from a defect in sanitizing HTTP headers combined with the library's native SSRF (Server-Side Request Forgery) functionality. Exploitation of this vulnerability would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems or completely compromise a cloud infrastructure via bypassing the AWS IMDSv2 protection mechanism. It is classified critical with a severity score of 10.0 according to CVSS V3.1.

• Axios versions prior to version 1.15.0;