---
id: 2445
title: "Axios CVE-2026-40175: a critical bug that’s… not exploitable"
cve: CVE-2026-40175
cvss: 4.8
severity: medium
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/axios-cve-2026-40175-a-critical-bug-thats-not-exploitable"
published_at: "2026-04-14 00:00"
tags: ["prototype-pollution", "request-smuggling", "cve", "ssrf", "vulnerability-analysis", "nodejs", "axios"]
phying_url: "https://phying.com/item/2445"
lang: en
---

# Axios CVE-2026-40175: a critical bug that’s… not exploitable

## Summary

Aikido analyzed the 'critical' Axios CVE-2026-40175 gadget chain—prototype pollution to CRLF injection to SSRF—and concluded Node.js blocks CRLF in headers, making it unexploitable in practice.

## Intelligence Metadata

- **Sources:** aikido.dev
- **CVE:** CVE-2026-40175
- **CVSS:** 4.8
- **Published:** 2026-04-14 00:00
- **Original:** https://www.aikido.dev/blog/axios-cve-2026-40175-a-critical-bug-thats-not-exploitable
- **Phying News:** https://phying.com/item/2445