CVE-2024-39338
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
CVE-2024-39338- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
CVE-2024-39338- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2024-2537
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
EUVD-2024-2537- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8hc4-vh64-cxmj No score
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
GHSA-8hc4-vh64-cxmj- Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
CVE-2024-39338- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-39338
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
DEBIAN-CVE-2024-39338- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2024-39338
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
UBUNTU-CVE-2024-39338- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1777855414 No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.15.3-tuxcare.3.
- Record
CLSA-2026-1777855414- Updated
- 2026-11-02
OSVCLSA-2026-1784943211 No score
TuxCare security update for axios (8 CVEs)
TuxCare rebuilt axios to address 8 CVEs. Fixed in 1.6.8-tuxcare.2.
- Record
CLSA-2026-1784943211- Updated
- 2026-11-02
OSVCLSA-2026-1785291680 No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.33.0-tuxcare.3.
- Record
CLSA-2026-1785291680- Updated
- 2026-11-02
OSVCLSA-2026-1790760631 No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.18.1-tuxcare.6.
- Record
CLSA-2026-1790760631- Updated
- 2026-11-02
OSVCLSA-2026-1792488799 No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.19.2-tuxcare.6.
- Record
CLSA-2026-1792488799- Updated
- 2026-11-02
OSVGHSA-8hc4-vh64-cxmj No score
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
GHSA-8hc4-vh64-cxmj- Weakness
- CWE-918
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14282-1 No score
velociraptor-0.7.0.4.git97.675e45f9-12.1 on GA media
These are all security issues fixed in the velociraptor-0.7.0.4.git97.675e45f9-12.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14282-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-39338 No score
CVE-2024-39338 in axios - Patched by Root
Root has patched CVE-2024-39338 in the axios package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-39338- Updated
- 2026-11-06
OSVSUSE-SU-2024:3771-1 No score
Security update for pgadmin4
This update for pgadmin4 fixes the following issues:
- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)
- Record
SUSE-SU-2024:3771-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
axiosnpm |
1.3.2 to 1.7.3 | 1.7.4 |
axiosTuxCare:npm |
0.15.3-tuxcare.0 up to 0.15.3-tuxcare.3, plus listed versions 0.15.30.15.3-tuxcare.10.15.3-tuxcare.2 |
0.15.3-tuxcare.3 |
axiosTuxCare:npm From an advisory covering 8 CVEs |
1.6.8-tuxcare.0 up to 1.6.8-tuxcare.2, plus listed versions 1.6.81.6.8-tuxcare.1 |
1.6.8-tuxcare.2 |
axiosTuxCare:npm |
0.33.0-tuxcare.0 up to 0.33.0-tuxcare.3, plus listed versions 0.33.00.33.0-tuxcare.10.33.0-tuxcare.2 |
0.33.0-tuxcare.3 |
axiosTuxCare:npm |
0.18.1-tuxcare.0 up to 0.18.1-tuxcare.6, plus listed versions 0.18.10.18.1-tuxcare.10.18.1-tuxcare.20.18.1-tuxcare.30.18.1-tuxcare.40.18.1-tuxcare.5 |
0.18.1-tuxcare.6 |
axiosTuxCare:npm |
0.19.2-tuxcare.0 up to 0.19.2-tuxcare.6, plus listed versions 0.19.20.19.2-tuxcare.10.19.2-tuxcare.20.19.2-tuxcare.30.19.2-tuxcare.40.19.2-tuxcare.5 |
0.19.2-tuxcare.6 |
node-axiosDebian:13 |
before 1.7.4+dfsg-1 | 1.7.4+dfsg-1 |
node-axiosDebian:14 |
before 1.7.4+dfsg-1 | 1.7.4+dfsg-1 |
axiosnpm |
1.3.2 up to 1.7.4 | 1.7.4 |
axiosRoot:npm |
before 1.6.0-aikido.1 | 1.6.0-aikido.11.6.5-aikido.11.6.5-aikido.21.6.0-aikido.21.6.0-aikido.31.6.5-aikido.3 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
@rootio/axiosRoot:npm |
before 1.6.0-root.io.1 | 1.6.0-root.io.11.6.5-root.io.11.6.5-root.io.21.6.0-root.io.21.6.0-root.io.31.6.5-root.io.3 |
pgadmin4SUSE:Linux Enterprise Module for Python 3 15 SP6 From an advisory covering 10 CVEs |
before 8.5-150600.3.6.1 | 8.5-150600.3.6.1 |
pgadmin4openSUSE:Leap 15.6 From an advisory covering 10 CVEs |
before 8.5-150600.3.6.1 | 8.5-150600.3.6.1 |
node-axiosUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.19.0+dfsg-20.19.0+dfsg-2ubuntu0.1~esm1 |
None known |
node-axiosUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 0.21.1+dfsg-10.23.0+dfsg-20.24.0+dfsg-10.25.0+dfsg-20.26.0+dfsg-10.26.0+dfsg-1ubuntu0.1~esm1 |
None known |
node-axiosUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.2.1+dfsg-11.5.1+dfsg-11.6.2+dfsg-11.6.8+dfsg-21.6.8+dfsg-2ubuntu0.1~esm1 |
None known |
node-axiosUbuntu:25.10 |
All versions, plus listed versions 1.7.9+dfsg-11.8.4+dfsg-11.11.0+dfsg-1 |
None known |
node-axiosUbuntu:26.10 |
All versions, plus listed versions 1.13.2+dfsg-1build11.16.0-11.18.0-11.19.0-1 |
None known |
node-axiosUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.2+dfsg-1build11.13.2+dfsg-1ubuntu0.1~esm1 |
None known |
velociraptoropenSUSE:Tumbleweed |
before 0.7.0.4.git97.675e45f9-12.1 | 0.7.0.4.git97.675e45f9-12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39338 is a high vulnerability (CVSS 7.5) in Axios, published August 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in axios 1.7.4.
References
github.com/axios/axios/releases
jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html
nvd.nist.gov/vuln/detail/CVE-2024-39338
Show 29 moreShow less
security-tracker.debian.org/tracker/CVE-2024-39338
suse.com/support/update/announcement/2024/suse-su-20243771-1
bugzilla.suse.com/1224295
ubuntu.com/security/CVE-2024-39338
cve.org/CVERecord?id=CVE-2024-39338