[ Vendor · 12 CVEs ]
axios
CVEs affecting axios published in the last 30 days, plus any axios CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-101899 | 13 Oct 2026 | CVSS 6.9 | Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as… | Fix |
| CVE-2026-101906 | 28 Sep 2026 | CVSS 8.2 | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect LocationAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot… | Fix |
| CVE-2026-101907 | 28 Sep 2026 | CVSS 7.0 | Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFAxios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect… | Fix |
| CVE-2026-101908 | 28 Sep 2026 | CVSS 6.9 | Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsAxios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized… | Fix |
| CVE-2026-101909 | 28 Sep 2026 | CVSS 8.3 | Axios: Prototype Pollution Gadget in axios toFormData OptionsAxios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited… | Fix |
| CVE-2026-101900 | 28 Sep 2026 | CVSS 6.9 | Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersAxios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append… | Fix |
| CVE-2026-101901 | 28 Sep 2026 | CVSS 8.2 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session InitializationAxios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling… | Fix |
| CVE-2026-101902 | 28 Sep 2026 | CVSS 6.9 | Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP MethodAxios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an… | Fix |
| CVE-2026-101903 | 28 Sep 2026 | CVSS 8.2 | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters… | Fix |
| CVE-2026-101904 | 28 Sep 2026 | CVSS 6.9 | Axios: Header Injection via Inherited headers After Minimal InterceptorAxios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited… | Fix |
| CVE-2026-101905 | 28 Sep 2026 | CVSS 7.6 | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies… | Fix |
| CVE-2026-101898 | 28 Sep 2026 | CVSS 7.0 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsAxios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply… | Fix |