{"id":"CVE-2026-40175","kind":"vulnerability","aliases":["CVE-2026-40175"],"related":[],"title":"Axios: prototype pollution can crash apps or run unauthorized code","description":"WAF Release - 2026-06-09 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJune 9, 2026\n\n## WAF Release - 2026-06-09\n\nThis release introduces new detections for a critical SQL injection vulnerability in Drupal installations utilizing PostgreSQL (CVE-2026-9082), alongside targeted protection for an unsafe deserialization flaw in the Mirasvit Cache Warmer extension (CVE-2026-45247). Additionally, this release includes coverage for a prototype pollution vector in Axios (CVE-2026-40175) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic.\n\nKey Findings\n\n- CVE-2026-9082: A database abstraction vulnerability affects Drupal sites configured with a PostgreSQL backend. Remote, unauthenticated attackers can exploit this flaw via crafted inputs to inject malicious SQL commands and access or manipulate backend data.\n- CVE-2026-45247: A PHP Object Injection vulnerability exists in the Mirasvit Cache Warmer extension for Magento and Adobe Commerce. This flaw stems from unsafe deserialization of untrusted user input, enabling unauthenticated attackers to execute arbitrary code on the hosting server.\n- CVE-2026-40175: A prototype pollution vulnerability affects the Axios HTTP client library. Attackers can exploit this to inject malicious properties into the global JavaScript object prototype, potentially causing application crashes (Denial of Service) or executing unauthorized code depending on the application structure.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate database contents, or induce application crashes, leading to severe operational disruption or complete server compromise. These newly deployed signatures intercept these advanced malicious payloads at the edge before they can interact with vulnerable software configurations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...387cf935 | N/A | Axios - Prototype Pollution - CVE:CVE-2026-40175 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...417eb9e0 | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - Body | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...fd3857fd | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...aee241d2 | N/A | SQLi - Obfuscated Boolean - Body | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d8620070 | N/A | SQLi - Obfuscated Boolean - Headers | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e0be4d47 | N/A | Mirasvit Cache Warmer - PHP Object Injection - CVE:CVE-2026-45247 | N/A | Block | This is a new detection. |","summary":"Axios, a JavaScript HTTP client used in browsers and Node.js, has a prototype pollution flaw that lets an attacker inject properties into the global object prototype. The sources say this can crash the application or execute unauthorized code, depending on how the application is structured.","severity":"high","cvss":8.1,"epss":0.02024,"exploited":false,"exploited_at":null,"products":[{"name":"axios","fixed":["0.31.0"],"affected":"< 0.31.0","ecosystem":"vendor"},{"name":"axios","fixed":["1.15.0"],"affected":">= 1.0.0, < 1.15.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","cloudflare","frontend","javascript","lab-disclosure","node.js","npm","package"],"not_affected_if":["axios-0.31.0-or-later","axios-1.15.0-or-later"],"how_to_check":"- Run `npm ls axios` in each project and check the resolved version.\n- Affected: any `axios` below `0.31.0`, and `axios` from `1.0.0` up to but not including `1.15.0`.\n- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for transitive copies of axios.","fix":"- Upgrade axios to `0.31.0` on the 0.x line or `1.15.0` on the 1.x line.\n- Rebuild and redeploy after updating the lockfile.\n- Cloudflare's WAF added a managed block rule (Axios - Prototype Pollution - CVE-2026-40175), but this is a mitigation at the edge, not a substitute for upgrading.","status":"open","published_at":"2026-04-10T20:16:22+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:53+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade axios to `0.31.0` on the 0.x line or `1.15.0` on the 1.x line.\n- Rebuild and redeploy after updating the lockfile.\n- Cloudflare's WAF added a managed block rule (Axios - Prototype Pollution - CVE-2026-40175), but this is a mitigation at the edge, not a substitute for upgrading.","reach":"unknown","title":"Axios: prototype pollution can crash apps or run unauthorized code","impact":"high","summary":"Axios, a JavaScript HTTP client used in browsers and Node.js, has a prototype pollution flaw that lets an attacker inject properties into the global object prototype. The sources say this can crash the application or execute unauthorized code, depending on how the application is structured.","category":"package","nicknames":[],"who_cares":["npm","javascript","node.js","browser","frontend"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Application crashes or unauthorized code runs, depending on application structure","analyst_note":"Confirm the exact trigger path and whether exploitation is confirmed, using the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-40175 and the upstream axios advisory.","how_to_check":"- Run `npm ls axios` in each project and check the resolved version.\n- Affected: any `axios` below `0.31.0`, and `axios` from `1.0.0` up to but not including `1.15.0`.\n- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for transitive copies of axios.","needs_analyst":true,"not_affected_if":["axios-0.31.0-or-later","axios-1.15.0-or-later"],"who_is_affected":"Applications that bundle or run an axios version in the affected ranges, in the browser or on Node.js. The sources say exposure depends on application structure, and they do not name a specific code path or input that triggers it. Projects already on `0.31.0` or `1.15.0` or later are outside the listed ranges.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001222,"input_tokens":4532,"output_tokens":1538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-06':77C,93C '-09':78C,94C '-2026':12A,15A,112C,129C,144C,169C,205C,246C,360C,379C,399C,454C '-40175':13A,16A,145C,247C,361C '-45247':130C,206C,455C '-9082':113C,170C,380C,400C '2026':76C,89C,92C '387cf935':353C '417eb9e0':372C '9':88C 'abstract':173C 'access':199C 'action':346C,348C 'addit':131C 'adob':222C 'advanc':324C 'aee241d2':412C 'affect':175C,252C 'allow':295C 'alongsid':114C 'app':6A 'applic':62B,71B,274C,286C,307C 'arbitrari':239C,300C 'attack':47B,185C,236C,258C,297C 'attempt':161C 'axio':1A,29B,142C,254C,355C 'axios':17A,18A 'backend':182C,202C 'block':155C,363C,383C,403C,457C 'bodi':381C,417C 'boolean':164C,416C,432C 'browser':19B,36B 'bypass':160C 'cach':125C,216C,447C 'caus':273C 'changelog':79C,80C 'client':33B,256C 'cloudflar':20B,86C,350C,369C,389C,409C,425C,441C 'code':10A,66B,240C,282C,301C 'command':197C 'comment':349C 'commerc':223C 'complet':315C 'compromis':317C 'configur':178C,337C 'content':304C 'could':294C 'coverag':135C 'craft':191C 'crash':5A,60B,275C,308C 'critic':102C 'cve':11A,14A,111C,128C,143C,168C,204C,245C,358C,359C,377C,378C,397C,398C,452C,453C 'd8620070':428C 'data':203C 'databas':172C,303C 'denial':276C 'depend':67B,283C 'deploy':320C 'descript':344C 'deseri':120C,229C 'design':151C 'detect':99C,368C,388C,408C,424C,440C,462C 'disabl':419C,435C 'disclosur':25B 'disrupt':313C 'drupal':107C,176C,374C,394C 'e0be4d47':444C 'edg':329C 'enabl':234C 'execut':64B,238C,280C,299C 'exist':212C 'exploit':187C,260C,290C 'extens':127C,218C 'fd3857fd':392C 'find':167C 'flaw':43B,121C,189C,225C 'frontend':21B 'generic':149C 'global':52B,268C 'header':433C 'host':243C 'http':32B,255C 'id':340C,343C 'identifi':153C 'impact':288C 'improv':84C 'includ':134C 'induc':306C 'inject':48B,104C,158C,194C,210C,263C,451C 'input':192C,233C 'instal':108C 'interact':333C 'intercept':322C 'introduc':97C 'javascript':22B,31B,269C 'june':87C 'key':166C 'lab':24B 'lab-disclosur':23B 'lead':309C 'legaci':341C 'let':45B 'leverag':162C 'librari':257C 'log':362C,382C,402C 'logic':165C 'magento':220C 'malici':195C,264C,325C 'manag':351C,370C,390C,410C,426C,442C 'manipul':201C,302C 'mirasvit':124C,215C,446C 'n/a':354C,373C,393C,413C,418C,429C,434C,445C,456C 'new':81C,98C,148C,347C,367C,387C,407C,423C,439C,461C 'newli':319C 'node.js':26B,38B 'npm':27B 'obfusc':163C,415C,431C 'object':53B,209C,270C,450C 'oper':312C 'packag':28B 'payload':326C 'php':208C,449C 'pollut':3A,42B,139C,250C,357C 'postgresql':110C,181C,375C,395C 'potenti':272C 'previous':345C 'properti':49B,265C 'protect':116C 'prototyp':2A,41B,54B,138C,249C,271C,356C 'releas':75C,91C,96C,133C 'remot':183C 'rule':150C,339C,342C 'ruleset':338C,352C,371C,391C,411C,427C,443C 'run':8A 'say':57B 'server':244C,316C 'servic':278C 'sever':311C 'signatur':321C 'site':177C 'softwar':336C 'sophist':156C 'sourc':56B 'sql':103C,157C,196C 'sqli':159C,376C,396C,414C,430C 'stem':226C 'structur':73B,287C 'success':289C 'target':115C 'unauthent':184C,235C,296C 'unauthor':9A,65B,281C 'unsaf':119C,228C 'untrust':231C 'updat':82C 'uri':401C 'use':34B 'user':232C 'util':109C 'vector':140C 'via':190C 'vulner':105C,174C,211C,251C,293C,335C 'waf':74C,90C 'warmer':126C,217C,448C","nicknames":[],"mitigations":[],"who_affected":"Applications that bundle or run an axios version in the affected ranges, in the browser or on Node.js. The sources say exposure depends on application structure, and they do not name a specific code path or input that triggers it. Projects already on `0.31.0` or `1.15.0` or later are outside the listed ranges.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-10T20:16:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/#CVE-2026-40175","url":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/","severity":null,"published_at":"2026-06-09T18:55:57+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"Cloudflare: WAF Release - 2026-06-09 · Changelog"},{"source":"nvd","external_id":"CVE-2026-40175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40175","severity":null,"published_at":"2026-04-10T20:16:22+00:00","modified_at":"2026-09-09T13:19:49+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-40175","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-40175","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2904,"url":"https://developers.cloudflare.com/changelog/post/2026-06-09-waf-release/","title":"Cloudflare: WAF Release - 2026-06-09 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-06-09 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJune 9, 2026\n\n## WAF Release - 2026-06-09\n\nThis release introduces new detections for a critical SQL injection vulnerability in Drupal installations utilizing PostgreSQL (CVE-2026-9082), alongside targeted protection for an unsafe deserialization flaw in the Mirasvit Cache Warmer extension (CVE-2026-45247). Additionally, this release includes coverage for a prototype pollution vector in Axios (CVE-2026-40175) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic.\n\nKey Findings\n\n- CVE-2026-9082: A database abstraction vulnerability affects Drupal sites configured with a PostgreSQL backend. Remote, unauthenticated attackers can exploit this flaw via crafted inputs to inject malicious SQL commands and access or manipulate backend data.\n- CVE-2026-45247: A PHP Object Injection vulnerability exists in the Mirasvit Cache Warmer extension for Magento and Adobe Commerce. This flaw stems from unsafe deserialization of untrusted user input, enabling unauthenticated attackers to execute arbitrary code on the hosting server.\n- CVE-2026-40175: A prototype pollution vulnerability affects the Axios HTTP client library. Attackers can exploit this to inject malicious properties into the global JavaScript object prototype, potentially causing application crashes (Denial of Service) or executing unauthorized code depending on the application structure.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate database contents, or induce application crashes, leading to severe operational disruption or complete server compromise. These newly deployed signatures intercept these advanced malicious payloads at the edge before they can interact with vulnerable software configurations.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...387cf935 | N/A | Axios - Prototype Pollution - CVE:CVE-2026-40175 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...417eb9e0 | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - Body | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...fd3857fd | N/A | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...aee241d2 | N/A | SQLi - Obfuscated Boolean - Body | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d8620070 | N/A | SQLi - Obfuscated Boolean - Headers | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e0be4d47 | N/A | Mirasvit Cache Warmer - PHP Object Injection - CVE:CVE-2026-45247 | N/A | Block | This is a new detection. |","published_at":"2026-06-09T18:55:57+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}