CVE-2024-39338
Server-Side Request Forgery in axios
CVE-2024-39338 is a high vulnerability (CVSS 7.5) in Axios, published August 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in axios 1.7.4.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 1.21%EPSS, 68th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.7.4axios +19 more
Description
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
axiosnpm | 1.3.2 to 1.7.3 | 1.7.4 |
axiosTuxCare:npm | 0.15.3-tuxcare.0 up to 0.15.3-tuxcare.3, plus listed versions 0.15.30.15.3-tuxcare.10.15.3-tuxcare.2 | 0.15.3-tuxcare.3 |
axiosTuxCare:npm From an advisory covering 8 CVEs | 1.6.8-tuxcare.0 up to 1.6.8-tuxcare.2, plus listed versions 1.6.81.6.8-tuxcare.1 | 1.6.8-tuxcare.2 |
axiosTuxCare:npm | 0.33.0-tuxcare.0 up to 0.33.0-tuxcare.3, plus listed versions 0.33.00.33.0-tuxcare.10.33.0-tuxcare.2 | 0.33.0-tuxcare.3 |
axiosTuxCare:npm | 0.18.1-tuxcare.0 up to 0.18.1-tuxcare.6, plus listed versions 0.18.10.18.1-tuxcare.10.18.1-tuxcare.20.18.1-tuxcare.30.18.1-tuxcare.40.18.1-tuxcare.5 | 0.18.1-tuxcare.6 |
axiosTuxCare:npm | 0.19.2-tuxcare.0 up to 0.19.2-tuxcare.6, plus listed versions 0.19.20.19.2-tuxcare.10.19.2-tuxcare.20.19.2-tuxcare.30.19.2-tuxcare.40.19.2-tuxcare.5 | 0.19.2-tuxcare.6 |
node-axiosDebian:13 | before 1.7.4+dfsg-1 | 1.7.4+dfsg-1 |
node-axiosDebian:14 | before 1.7.4+dfsg-1 | 1.7.4+dfsg-1 |
axiosnpm | 1.3.2 up to 1.7.4 | 1.7.4 |
axiosRoot:npm | before 1.6.0-aikido.1 | 1.6.0-aikido.11.6.5-aikido.11.6.5-aikido.21.6.0-aikido.21.6.0-aikido.31.6.5-aikido.3 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
@rootio/axiosRoot:npm | before 1.6.0-root.io.1 | 1.6.0-root.io.11.6.5-root.io.11.6.5-root.io.21.6.0-root.io.21.6.0-root.io.31.6.5-root.io.3 |
pgadmin4SUSE:Linux Enterprise Module for Python 3 15 SP6 From an advisory covering 10 CVEs | before 8.5-150600.3.6.1 | 8.5-150600.3.6.1 |
pgadmin4openSUSE:Leap 15.6 From an advisory covering 10 CVEs | before 8.5-150600.3.6.1 | 8.5-150600.3.6.1 |
node-axiosUbuntu:Pro:20.04:LTS | All versions, plus listed versions 0.19.0+dfsg-20.19.0+dfsg-2ubuntu0.1~esm1 | None known |
node-axiosUbuntu:Pro:22.04:LTS | All versions, plus listed versions 0.21.1+dfsg-10.23.0+dfsg-20.24.0+dfsg-10.25.0+dfsg-20.26.0+dfsg-10.26.0+dfsg-1ubuntu0.1~esm1 | None known |
node-axiosUbuntu:Pro:24.04:LTS | All versions, plus listed versions 1.2.1+dfsg-11.5.1+dfsg-11.6.2+dfsg-11.6.8+dfsg-21.6.8+dfsg-2ubuntu0.1~esm1 | None known |
node-axiosUbuntu:25.10 | All versions, plus listed versions 1.7.9+dfsg-11.8.4+dfsg-11.11.0+dfsg-1 | None known |
node-axiosUbuntu:26.10 | All versions, plus listed versions 1.13.2+dfsg-1build11.16.0-11.18.0-11.19.0-1 | None known |
node-axiosUbuntu:Pro:26.04:LTS | All versions, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.2+dfsg-1build11.13.2+dfsg-1ubuntu0.1~esm1 | None known |
velociraptoropenSUSE:Tumbleweed | before 0.7.0.4.git97.675e45f9-12.1 | 0.7.0.4.git97.675e45f9-12.1 |
What each source reports
NVD Score used
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
CVE-2024-39338- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
CVE-2024-39338- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2024-2537
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
EUVD-2024-2537- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8hc4-vh64-cxmjNo score
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
GHSA-8hc4-vh64-cxmj- Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
CVE-2024-39338- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-39338
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
DEBIAN-CVE-2024-39338- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2024-39338
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
UBUNTU-CVE-2024-39338- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1777855414No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.15.3-tuxcare.3.
- Record
CLSA-2026-1777855414- Updated
- 2026-11-02
OSVCLSA-2026-1784943211No score
TuxCare security update for axios (8 CVEs)
TuxCare rebuilt axios to address 8 CVEs. Fixed in 1.6.8-tuxcare.2.
- Record
CLSA-2026-1784943211- Updated
- 2026-11-02
OSVCLSA-2026-1785291680No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.33.0-tuxcare.3.
- Record
CLSA-2026-1785291680- Updated
- 2026-11-02
OSVCLSA-2026-1790760631No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.18.1-tuxcare.6.
- Record
CLSA-2026-1790760631- Updated
- 2026-11-02
OSVCLSA-2026-1792488799No score
TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.19.2-tuxcare.6.
- Record
CLSA-2026-1792488799- Updated
- 2026-11-02
OSVGHSA-8hc4-vh64-cxmjNo score
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
- Record
GHSA-8hc4-vh64-cxmj- Weakness
- CWE-918
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14282-1No score
velociraptor-0.7.0.4.git97.675e45f9-12.1 on GA media
These are all security issues fixed in the velociraptor-0.7.0.4.git97.675e45f9-12.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14282-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-39338No score
CVE-2024-39338 in axios - Patched by Root
Root has patched CVE-2024-39338 in the axios package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-39338- Updated
- 2026-11-06
OSVSUSE-SU-2024:3771-1No score
Security update for pgadmin4
This update for pgadmin4 fixes the following issues:
- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)
- Record
SUSE-SU-2024:3771-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/axios/axios/releases
jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html
nvd.nist.gov/vuln/detail/CVE-2024-39338
Show 29 moreShow less
security-tracker.debian.org/tracker/CVE-2024-39338
suse.com/support/update/announcement/2024/suse-su-20243771-1
bugzilla.suse.com/1224295
ubuntu.com/security/CVE-2024-39338
cve.org/CVERecord?id=CVE-2024-39338