Critical Axios Vulnerability Allows Remote Code Execution – PoC Released

A critical Axios vulnerability (CVE-2026-40175) in lib/adapters/http.js allows prototype-pollution-triggered header injection and request smuggling that can exfiltrate AWS metadata and steal IAM credentials, enabling full cloud account takeover; a PoC is published and Axios 1.15.0+ contains the required header validation fix, so immediate upgrades and dependency audits are recommended.