HTTP Response Splitting Affecting axios package, versions <1.15.0

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to HTTP Response Splitting via the merged HTTP header values received from third-party libraries. This can allow a chain attack from prototype pollution in dependencies escalate to remote code execution or full cloud environment compromise. An attacker can execute arbitrary code or access sensitive cloud metadata by injecting malicious headers with CRLF values.

Note:

This issue can be exploited only as part of a chained attack and requires successful Prototype Pollution in any third-party dependency.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release