{"vulnerability": "CVE-2026-40175", "sightings": [{"uuid": "7eda99ed-8aab-4429-8229-77c6efe4f013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://t.me/codeby_sec/9983", "content": "60 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e \u2014 \u0438 CVSS 10.0. \u041d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u0430 \u043b\u0438 \u0443\u0433\u0440\u043e\u0437\u0430?\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043d\u0430\u0448\u0435\u0434\u0448\u0438\u0439 \u0431\u0430\u0433 \u0432 Axios, \u0441\u0430\u043c \u0433\u043e\u0432\u043e\u0440\u0438\u0442: \u00ab\u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435 \u044d\u0442\u043e \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c\u00bb. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c NVD \u0441\u0442\u0430\u0432\u0438\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u0430\u043b\u043b.\n\n\ud83d\udd17 CVE-2026-40175 \u2014 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0438\u0437 \u0442\u0440\u0451\u0445 CWE:\n\u2022 CWE-113 \u2014 CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u0445\n\u2022 CWE-444 \u2014 HTTP Request Smuggling\n\u2022 CWE-918 \u2014 SSRF \u0434\u043e AWS IMDS\n\n\u0421\u0445\u0435\u043c\u0430 \u0430\u0442\u0430\u043a\u0438: \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u044f\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 (qs, minimist) \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u044f\u0435\u0442 Object.prototype \u2192 Axios \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u00ab\u0433\u0440\u044f\u0437\u043d\u043e\u0435\u00bb \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0438 merge \u043a\u043e\u043d\u0444\u0438\u0433\u043e\u0432 \u2192 CRLF \u0440\u0430\u0437\u0440\u044b\u0432\u0430\u0435\u0442 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 \u2192 \u043a\u043e\u043d\u0442\u0440\u0430\u0431\u0430\u043d\u0434\u043d\u044b\u0439 PUT \u0443\u0445\u043e\u0434\u0438\u0442 \u043d\u0430 169.254.169.254 \u0437\u0430 IMDSv2-\u0442\u043e\u043a\u0435\u043d\u043e\u043c.\n\n\ud83d\udca1 Scope: Changed \u0432 CVSS-\u0432\u0435\u043a\u0442\u043e\u0440\u0435 \u2014 \u0432\u043e\u0442 \u043f\u043e\u0447\u0435\u043c\u0443 10.0, \u0430 \u043d\u0435 9.8. \u0410\u0442\u0430\u043a\u0430 \u0432\u044b\u0445\u043e\u0434\u0438\u0442 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b Axios \u0438 \u0431\u044c\u0451\u0442 \u043f\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u2014 \u0433\u0434\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043b\u043e\u043c\u0430\u0435\u0442\u0441\u044f \u0438 \u0432 \u043a\u0430\u043a\u0438\u0445 edge-\u043a\u0435\u0439\u0441\u0430\u0445 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442:\n\nhttps://codeby.net/threads/cve-2026-40175-axios-uyazvimost-razbor-tsepochki-prototype-pollution-rce-i-obkhod-aws-imdsv2.92674/", "creation_timestamp": "2026-04-16T04:58:20.000000Z"}, {"uuid": "c09e35ea-ef39-4b37-966e-c428f2670f58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj6foo5zbs2o", "content": "", "creation_timestamp": "2026-04-10T22:47:01.975138Z"}, {"uuid": "0d8cc764-245b-45d3-86d2-e0a9b0f39fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj76jcka6z2a", "content": "", "creation_timestamp": "2026-04-11T06:11:25.895092Z"}, {"uuid": "a1d9c145-2a09-4b40-ad03-d4ce7c20fc1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj76p6yspj2w", "content": "", "creation_timestamp": "2026-04-11T06:14:43.542144Z"}, {"uuid": "6a79f71f-786b-42fb-9530-a192a3d11ab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mj7s26uhpe2x", "content": "", "creation_timestamp": "2026-04-11T12:00:53.036813Z"}, {"uuid": "165f7a8c-d4f0-478a-a919-8caa2eefc2a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-40175", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mjb6luixdd2p", "content": "", "creation_timestamp": "2026-04-12T01:18:11.581601Z"}, {"uuid": "c017ad68-c960-4e05-86b0-66446e9fbdcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/azu.bsky.social/post/3mjbulrf7362m", "content": "", "creation_timestamp": "2026-04-12T07:51:49.917589Z"}, {"uuid": "68cf7883-35ff-495a-8d1a-9f5d81d12f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mjcapmbtic2f", "content": "", "creation_timestamp": "2026-04-12T11:28:51.370238Z"}, {"uuid": "a5147206-c8c8-467d-bd0b-d8eebe023c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjdcdyzlgw2b", "content": "", "creation_timestamp": "2026-04-12T21:30:53.854235Z"}, {"uuid": "511ef852-fd97-4f80-a84d-f6402fa926e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mjdt2jxnih2t", "content": "", "creation_timestamp": "2026-04-13T02:29:38.244927Z"}, {"uuid": "fca5df38-cf38-4504-91ad-6c1a7fa12b31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/zenn.dev.web.brid.gy/post/3mjefqtpeu6j2", "content": "", "creation_timestamp": "2026-04-13T08:07:03.974385Z"}, {"uuid": "0bb104f8-d85e-4aee-9212-e586878bba06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/allaboutsecurity.bsky.social/post/3mjerdql2k22c", "content": "", "creation_timestamp": "2026-04-13T11:31:42.310057Z"}, {"uuid": "4e64a551-cf75-43af-a917-319ef12e7445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://www.acn.gov.it/portale/w/axios-disponibile-poc-per-lo-sfruttamento-della-cve-2026-40175", "content": "", "creation_timestamp": "2026-04-14T00:42:06.000000Z"}, {"uuid": "533ed77d-fa4d-4533-9306-5aab1b65b7c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mjhkriwdy527", "content": "", "creation_timestamp": "2026-04-14T14:12:04.675347Z"}, {"uuid": "3276ec64-1c27-4596-9f67-be2e3e268b1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mjhl7k67ij2n", "content": "", "creation_timestamp": "2026-04-14T14:19:55.014244Z"}, {"uuid": "c13eec84-02be-4e4a-a0e8-9a1d13caa321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mjhz6b5qca2s", "content": "", "creation_timestamp": "2026-04-14T18:29:44.426392Z"}, {"uuid": "a7129ea0-4cfe-4dc0-a196-436d7ab70777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mjhzv5wojw2t", "content": "", "creation_timestamp": "2026-04-14T18:42:32.357313Z"}, {"uuid": "8cec2200-1e56-41ce-914e-48060ba23bbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3079", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 axios \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439 CRLF \u0432 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\n\nBDU:2026-05270\nCVE-2026-40175\n\n\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u044f\u043c\u0438 http.js \u0438 xhr.js;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0440\u043e\u0432\u043d\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (WAF) \u0434\u043b\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0445\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e \u00ab\u0431\u0435\u043b\u044b\u043c \u0441\u043f\u0438\u0441\u043a\u0430\u043c\u00bb;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f (\u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f, \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438) \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442).\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.15.0 \u0438 \u0432\u044b\u0448\u0435\nhttps://github.com/axios/axios/releases/tag/v1.15.0", "creation_timestamp": "2026-04-15T14:32:34.000000Z"}, {"uuid": "2925467c-42c8-46fc-9d5d-6db5805df28e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mjilvg2lrh2f", "content": "", "creation_timestamp": "2026-04-15T00:04:48.106670Z"}, {"uuid": "994583d3-5cdc-4e66-8b71-7bb6e037f38e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mjixytnuqo2b", "content": "", "creation_timestamp": "2026-04-15T03:41:28.071886Z"}, {"uuid": "8ab832bb-63b0-45d5-a9a2-8b2e8f328539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mjj6zyqurk24", "content": "", "creation_timestamp": "2026-04-15T05:47:26.748951Z"}, {"uuid": "4b0f2a29-39f3-466b-b4de-d8dafec2dd19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-40175", "type": "seen", "source": "https://bsky.app/profile/azu.bsky.social/post/3mjjo2tzlli2w", "content": "", "creation_timestamp": "2026-04-15T10:16:17.725675Z"}, {"uuid": "4da4fade-633b-490d-b9dc-54821312f2b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-40175", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116416313280193109", "content": "", "creation_timestamp": "2026-04-16T20:39:29.718168Z"}, {"uuid": "00b0ec68-b527-482b-8f3d-35c8c759e5a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mjqhyulqqw26", "content": "", "creation_timestamp": "2026-04-18T03:16:27.483099Z"}, {"uuid": "4ef123fd-ac08-4f28-b523-0d521f4cd337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/technews4869.bsky.social/post/3mjvedzgyst2c", "content": "", "creation_timestamp": "2026-04-20T01:54:25.537945Z"}, {"uuid": "3470c502-9ed3-4ff1-94ed-e94f62a89d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mkai47fpgm2l", "content": "", "creation_timestamp": "2026-04-24T12:00:55.372463Z"}, {"uuid": "7891975e-9cc9-4d95-8e86-4be5bfb28fb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "Telegram/eprE6-d3GXEC8ugkZGIM7SguRfIlh9GwVUXl47JoaC36bCo", "content": "", "creation_timestamp": "2026-04-14T21:00:04.000000Z"}, {"uuid": "a80c82f2-b015-4fd1-9a41-04fb2da61023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "Telegram/kFmk3IZ3Z2qzEI0aWgGpXK0TflqqE9Sd4_8Q2OIAfUn3vfM", "content": "", "creation_timestamp": "2026-04-17T07:00:12.000000Z"}, {"uuid": "ae812889-25c2-496b-80cf-2381ba8d08ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "Telegram/bcPM6KFkFFoTNDuebGq860GuoAPywG-drW45FfbX6-QjDIA", "content": "", "creation_timestamp": "2026-04-12T11:00:12.000000Z"}, {"uuid": "0a3e21fe-40e9-4868-a226-c31bb0ce1d51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw", "content": "", "creation_timestamp": "2026-04-10T21:24:33.000000Z"}, {"uuid": "d1c40458-4862-4c2f-88f3-01b8c87fa316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "Telegram/YHKGRNeZCqA5W6bBS4Etxys6vDISWRUKBNhAAkEFGydsy_k", "content": "", "creation_timestamp": "2026-04-14T15:00:17.000000Z"}, {"uuid": "276b6b0a-e2a0-4102-a445-7410c998f252", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "Telegram/jkyf9FzBP6ABW034R3vx4BiSgaWbMQXv6i-pn331gsPUnTk", "content": "", "creation_timestamp": "2026-04-14T07:00:13.000000Z"}, {"uuid": "51457706-667e-470f-b760-4bfb7064aa98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "Telegram/jqsHB6FIdeMNMlYJLaE-SWbBIQ7X4SKPFQvaPULFC7d8_bM", "content": "", "creation_timestamp": "2026-04-14T15:00:07.000000Z"}, {"uuid": "37f1feef-8ebc-4326-b1b1-e3256ee44d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://t.me/cyberok_news/201", "content": "\ud83c\udf29 \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0431\u043b\u0430\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 Axios\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-40175 (CVSS 3.1: 10.0) \u0432 Axios \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 10 \u0430\u043f\u0440\u0435\u043b\u044f 2026 \u0433\u043e\u0434\u0430. \n\n\ud83d\udcca \u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0434\u043e 20.000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \n\u0418\u0437 \u043d\u0438\u0445 ~39% \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Axios. \n\n\u041e\u0446\u0435\u043d\u043a\u0430 \u00ab10/10\u00bb \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0430 \u0437\u0430 \u043d\u0430\u0438\u0445\u0443\u0434\u0448\u0438\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u0439. \u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445 Node.js \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c.\n\u0415\u0441\u043b\u0438 \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0435\u0435 \u043d\u0435\u043b\u044c\u0437\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e CVE?\n\n\u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438. \u0420\u0430\u043d\u0435\u0435 \u0432 Axios \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u0445. \u0414\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0441\u0440\u0435\u0434\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u0445 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442, \u0441\u0430\u043c\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u044d\u0442\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435.\n\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0448\u0438\u0440\u0435. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0431\u044b\u043b\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Axios \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0433\u0430\u0434\u0436\u0435\u0442\u0430\u00bb (Gadget Attack Chain): \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430 (Prototype Pollution) \u0432 \u043b\u044e\u0431\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u044d\u0441\u043a\u0430\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0434\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0438\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0445\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b AWS IMDSv2.\n\n\ud83e\udde0 \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\n1. \u0417\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u0435 Object.prototype \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 (qs, minimist, body-parser).\n2. Axios \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a (CRLF, \\r\\n), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0438 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0442\u044c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b.\n\u0421\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 Node.js (\u0438 \u0442\u0430\u043a\u0436\u0435 Bun/Deno) \u043d\u0435 \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0438\u043d\u044c\u0435\u043a\u0446\u0438\u044e CRLF \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438\n\n3. CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c HTTP\u2011\u0437\u0430\u043f\u0440\u043e\u0441 \u0442\u0438\u043f\u0430 PUT \u043a AWS IMDS \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u0430 \u0438 \u0447\u0442\u0435\u043d\u0438\u044f \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n4. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a IAM\u2011\u0442\u043e\u043a\u0435\u043d\u0430\u043c \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u043a\u0435.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u2022 \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0438\u0436\u0435 1.15.0. \n\u2022 \u041d\u0430 GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b 2 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC.\n\u2022 \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0434\u0435\u0444\u0435\u043a\u0442: \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 CR/LF \u0432 AxiosHeaders.set (lib/core/AxiosHeaders.js). \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c assertValidHeaderValue.\n\n\ud83d\udd3b CVSS 3.1: 10.0 (\u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u0445  9.9) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0430\u0441\u043f\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Axios \u0432 Node.js \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430. \n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 HTTP\u2011\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0442\u0438\u043f\u0430 PUT \u043a 169.254.169.254.\n\u2022 \u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 __proto__ \u0438\u043b\u0438 constructor.prototype \u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445 \u0438\u043b\u0438 \u043b\u043e\u0433\u0430\u0445 WAF.\n\u2022 \u0418\u043d\u044a\u0435\u043a\u0446\u0438\u0438 CRLF (%0d%0a, \\r\\n).\n\u2022 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0441 \u0447\u0443\u0436\u0438\u0445 IP.\n\u2022 \u041e\u0448\u0438\u0431\u043a\u0438 \u043f\u0430\u0440\u0441\u0438\u043d\u0433\u0430 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0438\u043b\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 HTTP 500 \u0432 \u043b\u043e\u0433\u0430\u0445 Node.js-\u0441\u0435\u0440\u0432\u0438\u0441\u0430.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Axios \u0434\u043e 1.15.0 (1.14.x \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b).\n2. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430 Prototype Pollution (npm audit + SCA).\n3. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a 169.254.169.254 \u0447\u0435\u0440\u0435\u0437 Network Policies / Security Groups.\n4. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c WAF \u043d\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 __proto__ \u0438 CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u043d\u0430 \u0432\u0445\u043e\u0434\u0435.\n\n\ud83d\udccc \u041a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0432\u044b\u0432\u043e\u0434\nAxios \u2014 \u043d\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u0432\u0437\u043b\u043e\u043c\u0430, \u0430 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u044c. \n\u041e\u0442\u043f\u0440\u0430\u0432\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0435 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430. \u0418\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e Axios \u0431\u0435\u0437 \u0430\u0443\u0434\u0438\u0442\u0430 \u0434\u0435\u0440\u0435\u0432\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0439 \u043c\u0435\u0440\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-08-04T13:00:19.393351Z"}, {"uuid": "b294c174-a277-40d1-aec9-e51eea25f001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01", "content": "View CSAF\n\nSummary\n\nSiemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namely the Axios HTTP client library. The vulnerability stems from a specific \"Gadget\" attack chain that allows prototype pollution in other third-party libraries, potentially allowing an attacker to execute arbitrary code. Siemens has released a new version for gWAP and recommends to update to the latest version.\n\nThe following versions of Siemens gWAP are affected:\n\n\n\ngWAP vers:intdot/<3.1.1 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 8\nSiemens\nSiemens gWAP\nImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-40175\n<div class=\"csaf-accordion-content\">\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific \"Gadget\" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens gWAP\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:gWAP</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V3.1.1 or later versionhttps://support.sw.siemens.com/product/284395347/\n</div>\n\nRelevant CWE: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported this vulnerability to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-876049 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-876049 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "fbfe697e-abab-4f04-9e76-aae4ec97d259", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://t.me/cyberok_news/201", "content": "\ud83c\udf29 \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0431\u043b\u0430\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 Axios\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-40175 (CVSS 3.1: 10.0) \u0432 Axios \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 10 \u0430\u043f\u0440\u0435\u043b\u044f 2026 \u0433\u043e\u0434\u0430. \n\n\ud83d\udcca \u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0434\u043e 20.000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \n\u0418\u0437 \u043d\u0438\u0445 ~39% \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Axios. \n\n\u041e\u0446\u0435\u043d\u043a\u0430 \u00ab10/10\u00bb \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0430 \u0437\u0430 \u043d\u0430\u0438\u0445\u0443\u0434\u0448\u0438\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u0439. \u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445 Node.js \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c.\n\u0415\u0441\u043b\u0438 \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0435\u0435 \u043d\u0435\u043b\u044c\u0437\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e CVE?\n\n\u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438. \u0420\u0430\u043d\u0435\u0435 \u0432 Axios \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u0445. \u0414\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0441\u0440\u0435\u0434\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u0445 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442, \u0441\u0430\u043c\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u044d\u0442\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435.\n\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0448\u0438\u0440\u0435. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0431\u044b\u043b\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Axios \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0433\u0430\u0434\u0436\u0435\u0442\u0430\u00bb (Gadget Attack Chain): \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430 (Prototype Pollution) \u0432 \u043b\u044e\u0431\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u044d\u0441\u043a\u0430\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0434\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0438\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0445\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b AWS IMDSv2.\n\n\ud83e\udde0 \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\n1. \u0417\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u0435 Object.prototype \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 (qs, minimist, body-parser).\n2. Axios \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a (CRLF, \\r\\n), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0438 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0442\u044c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b.\n\u0421\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 Node.js (\u0438 \u0442\u0430\u043a\u0436\u0435 Bun/Deno) \u043d\u0435 \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0438\u043d\u044c\u0435\u043a\u0446\u0438\u044e CRLF \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438\n\n3. CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c HTTP\u2011\u0437\u0430\u043f\u0440\u043e\u0441 \u0442\u0438\u043f\u0430 PUT \u043a AWS IMDS \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u0430 \u0438 \u0447\u0442\u0435\u043d\u0438\u044f \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n4. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a IAM\u2011\u0442\u043e\u043a\u0435\u043d\u0430\u043c \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u043a\u0435.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u2022 \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0438\u0436\u0435 1.15.0. \n\u2022 \u041d\u0430 GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b 2 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC.\n\u2022 \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0434\u0435\u0444\u0435\u043a\u0442: \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 CR/LF \u0432 AxiosHeaders.set (lib/core/AxiosHeaders.js). \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c assertValidHeaderValue.\n\n\ud83d\udd3b CVSS 3.1: 10.0 (\u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u0445  9.9) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0430\u0441\u043f\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Axios \u0432 Node.js \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430. \n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 HTTP\u2011\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0442\u0438\u043f\u0430 PUT \u043a 169.254.169.254.\n\u2022 \u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 __proto__ \u0438\u043b\u0438 constructor.prototype \u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445 \u0438\u043b\u0438 \u043b\u043e\u0433\u0430\u0445 WAF.\n\u2022 \u0418\u043d\u044a\u0435\u043a\u0446\u0438\u0438 CRLF (%0d%0a, \\r\\n).\n\u2022 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0441 \u0447\u0443\u0436\u0438\u0445 IP.\n\u2022 \u041e\u0448\u0438\u0431\u043a\u0438 \u043f\u0430\u0440\u0441\u0438\u043d\u0433\u0430 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0438\u043b\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 HTTP 500 \u0432 \u043b\u043e\u0433\u0430\u0445 Node.js-\u0441\u0435\u0440\u0432\u0438\u0441\u0430.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Axios \u0434\u043e 1.15.0 (1.14.x \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b).\n2. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430 Prototype Pollution (npm audit + SCA).\n3. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a 169.254.169.254 \u0447\u0435\u0440\u0435\u0437 Network Policies / Security Groups.\n4. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c WAF \u043d\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 __proto__ \u0438 CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u043d\u0430 \u0432\u0445\u043e\u0434\u0435.\n\n\ud83d\udccc \u041a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0432\u044b\u0432\u043e\u0434\nAxios \u2014 \u043d\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u0432\u0437\u043b\u043e\u043c\u0430, \u0430 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u044c. \n\u041e\u0442\u043f\u0440\u0430\u0432\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0435 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430. \u0418\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e Axios \u0431\u0435\u0437 \u0430\u0443\u0434\u0438\u0442\u0430 \u0434\u0435\u0440\u0435\u0432\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0439 \u043c\u0435\u0440\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-08-05T00:00:36.133429Z"}, {"uuid": "3c281ca8-cb15-45a7-9ca8-a2e21690bbb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://api.github.com/repos/axios/axios/security-advisories/GHSA-fvcv-3m26-pcqx", "content": "", "creation_timestamp": "2026-04-09T14:01:33.000000Z"}, {"uuid": "f412490b-7398-4f79-b910-5c98919fab74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx", "content": "", "creation_timestamp": "2026-04-09T14:01:33.000000Z"}, {"uuid": "3adf0f26-448d-4b53-ad6c-ee5680b9ca8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://t.me/cyberok_news/201", "content": "\ud83c\udf29 \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043e\u0431\u043b\u0430\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 Axios\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-40175 (CVSS 3.1: 10.0) \u0432 Axios \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 10 \u0430\u043f\u0440\u0435\u043b\u044f 2026 \u0433\u043e\u0434\u0430. \n\n\ud83d\udcca \u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u0434\u043e 20.000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \n\u0418\u0437 \u043d\u0438\u0445 ~39% \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Axios. \n\n\u041e\u0446\u0435\u043d\u043a\u0430 \u00ab10/10\u00bb \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0430 \u0437\u0430 \u043d\u0430\u0438\u0445\u0443\u0434\u0448\u0438\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0441\u043e\u0431\u044b\u0442\u0438\u0439. \u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445 Node.js \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c.\n\u0415\u0441\u043b\u0438 \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0435\u0435 \u043d\u0435\u043b\u044c\u0437\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e CVE?\n\n\u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438. \u0420\u0430\u043d\u0435\u0435 \u0432 Axios \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u0445. \u0414\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0441\u0440\u0435\u0434\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u0445 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442, \u0441\u0430\u043c\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u0435\u0442 \u044d\u0442\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435.\n\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u043c\u0438\u043a\u0440\u043e\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0448\u0438\u0440\u0435. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0431\u044b\u043b\u0438 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c Axios \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0433\u0430\u0434\u0436\u0435\u0442\u0430\u00bb (Gadget Attack Chain): \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430 (Prototype Pollution) \u0432 \u043b\u044e\u0431\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u044d\u0441\u043a\u0430\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0434\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0438\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0445\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b AWS IMDSv2.\n\n\ud83e\udde0 \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\n1. \u0417\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u0435 Object.prototype \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 (qs, minimist, body-parser).\n2. Axios \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a (CRLF, \\r\\n), \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0438 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0442\u044c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0442\u0430\u043a\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b.\n\u0421\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 Node.js (\u0438 \u0442\u0430\u043a\u0436\u0435 Bun/Deno) \u043d\u0435 \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0438\u043d\u044c\u0435\u043a\u0446\u0438\u044e CRLF \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438\n\n3. CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c HTTP\u2011\u0437\u0430\u043f\u0440\u043e\u0441 \u0442\u0438\u043f\u0430 PUT \u043a AWS IMDS \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u0430 \u0438 \u0447\u0442\u0435\u043d\u0438\u044f \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445.\n4. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a IAM\u2011\u0442\u043e\u043a\u0435\u043d\u0430\u043c \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u043a\u0435.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u2022 \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0438\u0436\u0435 1.15.0. \n\u2022 \u041d\u0430 GitHub \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b 2 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC.\n\u2022 \u041a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0434\u0435\u0444\u0435\u043a\u0442: \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 CR/LF \u0432 AxiosHeaders.set (lib/core/AxiosHeaders.js). \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c assertValidHeaderValue.\n\n\ud83d\udd3b CVSS 3.1: 10.0 (\u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u0445  9.9) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0430\u0441\u043f\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Axios \u0432 Node.js \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430. \n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 HTTP\u2011\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0442\u0438\u043f\u0430 PUT \u043a 169.254.169.254.\n\u2022 \u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 __proto__ \u0438\u043b\u0438 constructor.prototype \u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445 \u0438\u043b\u0438 \u043b\u043e\u0433\u0430\u0445 WAF.\n\u2022 \u0418\u043d\u044a\u0435\u043a\u0446\u0438\u0438 CRLF (%0d%0a, \\r\\n).\n\u2022 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0441 \u0447\u0443\u0436\u0438\u0445 IP.\n\u2022 \u041e\u0448\u0438\u0431\u043a\u0438 \u043f\u0430\u0440\u0441\u0438\u043d\u0433\u0430 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0438\u043b\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 HTTP 500 \u0432 \u043b\u043e\u0433\u0430\u0445 Node.js-\u0441\u0435\u0440\u0432\u0438\u0441\u0430.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Axios \u0434\u043e 1.15.0 (1.14.x \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b).\n2. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430 Prototype Pollution (npm audit + SCA).\n3. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a 169.254.169.254 \u0447\u0435\u0440\u0435\u0437 Network Policies / Security Groups.\n4. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c WAF \u043d\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 __proto__ \u0438 CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u043d\u0430 \u0432\u0445\u043e\u0434\u0435.\n\n\ud83d\udccc \u041a\u043b\u044e\u0447\u0435\u0432\u043e\u0439 \u0432\u044b\u0432\u043e\u0434\nAxios \u2014 \u043d\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u0432\u0437\u043b\u043e\u043c\u0430, \u0430 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u044c. \n\u041e\u0442\u043f\u0440\u0430\u0432\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0435 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f\u0430. \u0418\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e Axios \u0431\u0435\u0437 \u0430\u0443\u0434\u0438\u0442\u0430 \u0434\u0435\u0440\u0435\u0432\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0439 \u043c\u0435\u0440\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-08-06T00:00:57.270719Z"}, {"uuid": "639e9a09-eba9-4129-a587-0fb879668597", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpritvqi5i2u", "content": "CVE-2026-40175 - @rootio/axios\nThe axios library used in some Root applications contains a security flaw that could allow an attacker to run malicious code on your server. This could happen if an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-07-03T21:35:23.813888Z"}, {"uuid": "b5be3d81-8072-4d05-9741-1f36c86a250f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcinpxw6n27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-40175 \u0432 Axios: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8B9BBA9D-E28A-4E12-9C66-AFEE7B4B3E9C", "creation_timestamp": "2026-07-10T15:47:11.987403Z"}, {"uuid": "fd004059-d853-4928-b945-c01f5f59c4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5u4r4v2b2j", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-40175](https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c)\n...\nhttps://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c #CVE #ZeroDay #PatchManagement", "creation_timestamp": "2026-07-21T12:54:20.698135Z"}, {"uuid": "e20859d5-3436-4fbb-a732-76e7d9dd763a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "seen", "source": "https://t.me/ZerodayAlert/656", "content": "CVSS 10.0, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 39% \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u0427\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0437\u043d\u0430\u0442\u044c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-40175 \u0432 Axios\n\n\u0412 Axios \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-40175 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 \u0434\u043e 10.0 \u043f\u043e CVSS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0438\u0436\u0435 1.15.0 \u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u044b. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c, \u0432 \u0420\u0443\u043d\u0435\u0442\u0435 \u043e\u043a\u043e\u043b\u043e 20 000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 39% \u0438\u0437 \u043d\u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0410\u0442\u0430\u043a\u0430 \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u0446\u0435\u043f\u043e\u0447\u043a\u0430. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 Prototype Pollution \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432\u0440\u043e\u0434\u0435 qs, minimist \u0438\u043b\u0438 body-parser. \u0417\u0430\u0442\u0435\u043c Axios \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u0445 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0430 \u0441\u0442\u0440\u043e\u043a\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438, \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0442\u044c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0438 \u043e\u0431\u0440\u0430\u0449\u0430\u0442\u044c\u0441\u044f \u043a AWS IMDS \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Axios \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.15.0, \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430 Prototype Pollution \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e npm audit \u0438 SCA, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a 169.254.169.254 \u0447\u0435\u0440\u0435\u0437 Network Policies \u0438\u043b\u0438 Security Groups, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c WAF \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 proto \u0438 CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u043d\u0430 \u0432\u0445\u043e\u0434\u0435.\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 #NodeJS\n\n@ZerodayAlert", "creation_timestamp": "2026-07-25T15:00:08.205881Z"}, {"uuid": "e80603e5-246f-40d7-a43d-e325b1da3693", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-40175", "type": "published-proof-of-concept", "source": "https://t.me/ZerodayAlert/656", "content": "CVSS 10.0, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 39% \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u0427\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0437\u043d\u0430\u0442\u044c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-40175 \u0432 Axios\n\n\u0412 Axios \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-40175 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 \u0434\u043e 10.0 \u043f\u043e CVSS. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0438\u0436\u0435 1.15.0 \u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u044b. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c, \u0432 \u0420\u0443\u043d\u0435\u0442\u0435 \u043e\u043a\u043e\u043b\u043e 20 000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 39% \u0438\u0437 \u043d\u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0410\u0442\u0430\u043a\u0430 \u0441\u0442\u0440\u043e\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u0446\u0435\u043f\u043e\u0447\u043a\u0430. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 Prototype Pollution \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432\u0440\u043e\u0434\u0435 qs, minimist \u0438\u043b\u0438 body-parser. \u0417\u0430\u0442\u0435\u043c Axios \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430\u0433\u0440\u044f\u0437\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430 \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u0445 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0430 \u0441\u0442\u0440\u043e\u043a\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438, \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0442\u044c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0438 \u043e\u0431\u0440\u0430\u0449\u0430\u0442\u044c\u0441\u044f \u043a AWS IMDS \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f IAM-\u0442\u043e\u043a\u0435\u043d\u043e\u0432.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Axios \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.15.0, \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430 Prototype Pollution \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e npm audit \u0438 SCA, \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a 169.254.169.254 \u0447\u0435\u0440\u0435\u0437 Network Policies \u0438\u043b\u0438 Security Groups, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c WAF \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 proto \u0438 CRLF-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u043d\u0430 \u0432\u0445\u043e\u0434\u0435.\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 #NodeJS\n\n@ZerodayAlert", "creation_timestamp": "2026-07-26T00:00:36.374112Z"}]}