PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Axios CVE-2026-40175: a critical bug that’s… not exploitable

aikido.dev | vulnerability | Medium | CVE-2026-40175 | #prototype-pollution | #request-smuggling | #cve | #ssrf | #vulnerability-analysis | #nodejs | #axios
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido analyzed the 'critical' Axios CVE-2026-40175 gadget chain—prototype pollution to CRLF injection to SSRF—and concluded Node.js blocks CRLF in headers, making it unexploitable in practice.
CVE
CVE-2026-40175
CVSS
4.8
Published
Collected

Related coverage

vulnerability · yeswehack.com
Server side prototype pollution, how to detect and exploit
Server-side prototype pollution in JavaScript: how prototypes work, how to detect vulnerable targets in black-box testing, and gadget hunting in libraries such as Express, Fastify and Axios.
blog · aikido.dev
Preventing prototype pollution in your repository
Prototype pollution causes 20-30% of CVEs in JavaScript/npm stacks and can lead to RCE. The article covers why Node's --frozen-intrinsics isn't ready and how the nopp library mitigates it.
research · portswigger.net
Server-side prototype pollution: Black-box detection without the DoS
Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.
research · portswigger.net
Exploiting prototype pollution in Node without the filesystem
A new SSPP exploitation technique: Node's --import flag accepts data: URLs, so polluting NODE_OPTIONS runs arbitrary code without touching the filesystem; Node considers this out of scope.
blog · jfrog.com
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
JFrog researchers show how CVSS overstates risk using JavaScript prototype pollution as a case study — Axios gadget chains included — after reassessing 96% of NVD criticals as lower severity.
vulnerability · aikido.dev
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
Back