Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Axios CVE-2026-40175: a critical bug that’s… not exploitable

aikido.dev | vulnerability | Medium | CVE-2026-40175 | #prototype-pollution | #request-smuggling | #cve | #ssrf | #vulnerability-analysis | #nodejs | #axios

Summary

Aikido analyzed the 'critical' Axios CVE-2026-40175 gadget chain—prototype pollution to CRLF injection to SSRF—and concluded Node.js blocks CRLF in headers, making it unexploitable in practice.
CVSS
4.8
Published
Collected

original ↗

Related coverage

  1. Server side prototype pollution, how to detect and exploit (yeswehack.com)
  2. Preventing prototype pollution in your repository (aikido.dev)
  3. Server-side prototype pollution: Black-box detection without the DoS (portswigger.net)
  4. Exploiting prototype pollution in Node without the filesystem (portswigger.net)
  5. Vulnerabilities in the Openfire Admin Console (swarm.ptsecurity.com)
  6. DOJO CHALLENGE #9 Winners! (yeswehack.com)

back