---
id: 6353
title: "Where Severity Scores Go Wrong: “Just Add Prototype Pollution”"
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/where-cve-severity-scores-go-wrong/"
published_at: "2026-07-01T13:15:07Z"
tags: ["prototype-pollution", "javascript", "cvss", "vulnerability-scoring", "axios", "jfrog-research"]
phying_url: "https://phying.com/item/6353"
lang: en
---

# Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

## Summary

JFrog researchers show how CVSS overstates risk using JavaScript prototype pollution as a case study — Axios gadget chains included — after reassessing 96% of NVD criticals as lower severity.

## Intelligence Metadata

- **Sources:** jfrog.com
- **Published:** 2026-07-01T13:15:07Z
- **Original:** https://jfrog.com/blog/where-cve-severity-scores-go-wrong/
- **Phying News:** https://phying.com/item/6353