{"id":"CVE-2024-39338","aliases":["CLSA-2026-1777855414","CLSA-2026-1784943211","CLSA-2026-1785291680","CLSA-2026-1790760631","CLSA-2026-1792488799","DEBIAN-CVE-2024-39338","EUVD-2024-2537","GHSA-8hc4-vh64-cxmj","ROOT-APP-NPM-CVE-2024-39338","SUSE-SU-2024:3771-1","UBUNTU-CVE-2024-39338","openSUSE-SU-2024:14282-1"],"status":"published","title":"Server-Side Request Forgery in axios","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01207,"percentile":0.6855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2024-08-09T00:00:00Z","modified":"2026-11-06T07:15:09Z","fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"axios","fixed_in":["0.15.3-tuxcare.3","0.33.0-tuxcare.3","0.18.1-tuxcare.6","0.19.2-tuxcare.6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-axios","fixed_in":["1.7.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.7.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"axios","fixed_in":["1.6.0-aikido.1","1.6.5-aikido.1","1.6.5-aikido.2","1.6.0-aikido.2","1.6.0-aikido.3","1.6.5-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/axios","fixed_in":["1.6.0-root.io.1","1.6.5-root.io.1","1.6.5-root.io.2","1.6.0-root.io.2","1.6.0-root.io.3","1.6.5-root.io.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","fixed_in":["0.7.0.4.git97.675e45f9-12.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.2"},{"last_affected":"1.7.3"},{"fixed":"1.7.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.15.3-tuxcare.0"},{"fixed":"0.15.3-tuxcare.3"}]}],"versions":["0.15.3","0.15.3-tuxcare.1","0.15.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.8-tuxcare.0"},{"fixed":"1.6.8-tuxcare.2"}]}],"versions":["1.6.8","1.6.8-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.33.0-tuxcare.0"},{"fixed":"0.33.0-tuxcare.3"}]}],"versions":["0.33.0","0.33.0-tuxcare.1","0.33.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.1-tuxcare.0"},{"fixed":"0.18.1-tuxcare.6"}]}],"versions":["0.18.1","0.18.1-tuxcare.1","0.18.1-tuxcare.2","0.18.1-tuxcare.3","0.18.1-tuxcare.4","0.18.1-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.2-tuxcare.0"},{"fixed":"0.19.2-tuxcare.6"}]}],"versions":["0.19.2","0.19.2-tuxcare.1","0.19.2-tuxcare.2","0.19.2-tuxcare.3","0.19.2-tuxcare.4","0.19.2-tuxcare.5"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.2"},{"fixed":"1.7.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-aikido.1"},{"fixed":"1.6.5-aikido.1"},{"fixed":"1.6.5-aikido.2"},{"fixed":"1.6.0-aikido.2"},{"fixed":"1.6.0-aikido.3"},{"fixed":"1.6.5-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-root.io.1"},{"fixed":"1.6.5-root.io.1"},{"fixed":"1.6.5-root.io.2"},{"fixed":"1.6.0-root.io.2"},{"fixed":"1.6.0-root.io.3"},{"fixed":"1.6.5-root.io.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9+dfsg-1","1.8.4+dfsg-1","1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git97.675e45f9-12.1"}]}]}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/releases","tags":["Release Notes","package","web"]},{"url":"https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html","tags":["Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39338","tags":["advisory"]},{"url":"https://github.com/axios/axios/issues/6463","tags":["web","report"]},{"url":"https://github.com/axios/axios/pull/6539","tags":["web"]},{"url":"https://github.com/axios/axios/pull/6543","tags":["web"]},{"url":"https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v1.7.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8hc4-vh64-cxmj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39338.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-39338","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1224366","tags":["report"]},{"url":"https://bugzilla.suse.com/1226967","tags":["report"]},{"url":"https://bugzilla.suse.com/1227248","tags":["report"]},{"url":"https://bugzilla.suse.com/1227252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229423","tags":["report"]},{"url":"https://bugzilla.suse.com/1229861","tags":["report"]},{"url":"https://bugzilla.suse.com/1230928","tags":["report"]},{"url":"https://bugzilla.suse.com/1231564","tags":["report"]},{"url":"https://bugzilla.suse.com/1231684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-39338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39338","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-39338","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-09T00:00:00Z","modified":"2024-08-15T19:26:34.904Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-2537","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-09T00:00:00Z","modified":"2024-08-15T19:26:34Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:17.186492Z"}],"ghsa":[{"id":"GHSA-8hc4-vh64-cxmj","title":"Server-Side Request Forgery in axios","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-12T15:30:49Z","modified":"2024-08-13T19:53:25Z","cwes":["CWE-918"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2024-39338","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-12T13:38:24.487Z","modified":"2026-06-17T07:41:44.793Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:18.563492Z"}],"osv":[{"id":"CVE-2024-39338","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-09T00:00:00Z","modified":"2026-10-28T02:31:05.147006149Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-39338","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-12T13:38:24.487Z","modified":"2026-11-02T12:02:37.544851618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"UBUNTU-CVE-2024-39338","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-12T13:38:00Z","modified":"2026-10-17T12:56:37.86106192Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"CLSA-2026-1777855414","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.15.3-tuxcare.3.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:45:49.582119663Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1784943211","title":"TuxCare security update for axios (8 CVEs)","description":"TuxCare rebuilt axios to address 8 CVEs. Fixed in 1.6.8-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.237279991Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291680","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.33.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.921295419Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790760631","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.18.1-tuxcare.6.","status":"published","published":"2026-09-30T09:30:31Z","modified":"2026-10-15T09:47:57.307642802Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792488799","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.19.2-tuxcare.6.","status":"published","published":"2026-10-20T09:33:19Z","modified":"2026-10-20T13:45:12.013393598Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"GHSA-8hc4-vh64-cxmj","title":"Server-Side Request Forgery in axios","description":"axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","status":"published","published":"2024-08-12T15:30:49Z","modified":"2026-09-10T03:50:17.335771859Z","cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"openSUSE-SU-2024:14282-1","title":"velociraptor-0.7.0.4.git97.675e45f9-12.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git97.675e45f9-12.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-20T00:00:00Z","modified":"2026-02-04T04:15:48.334602Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"ROOT-APP-NPM-CVE-2024-39338","title":"CVE-2024-39338 in axios - Patched by Root","description":"Root has patched CVE-2024-39338 in the axios package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T06:58:53Z","modified":"2026-11-06T07:15:09.36385127Z","updated_at":"2026-11-06T07:35:25.48647Z"},{"id":"SUSE-SU-2024:3771-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n","status":"published","published":"2024-10-29T12:55:34Z","modified":"2026-02-04T02:25:55.097314Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}