axios vulnerabilities (Root)
59 vulnerabilities.
-
axiosRoot AIKIDO-2026-291630 in axios - Patched by Root No score -
axiosRoot AIKIDO-2026-10823 in axios - Patched by Root No score -
axiosRoot AIKIDO-2026-10741 in axios - Patched by Root No score -
axiosRoot Axios: Prototype Pollution Gadget in axios toFormData Options 8.3 High -
axiosRoot Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF 7.0 High -
axiosRoot Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location 8.2 High -
axiosRoot Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection 7.6 High -
axiosRoot Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) 8.2 High -
axiosRoot Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization 8.2 High -
axiosRoot Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls 7.0 High -
axiosRoot AIKIDO-2026-10820 in axios - Patched by Root No score -
axiosRoot AIKIDO-2026-10819 in axios - Patched by Root No score -
axiosRoot AIKIDO-2026-10509 in axios - Patched by Root No score -
axiosRoot SNYK-JS-AXIOS-9403194 in axios - Patched by Root No score -
axiosRoot axios before 0.33.0 Prototype Pollution via nested option objects 6.3 Medium -
axiosRoot axios before 0.33.0 Prototype Pollution via Node HTTP adapter 8.3 High -
axiosRoot axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 6.9 Medium -
axiosRoot axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 6.3 Medium -
axiosRoot axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 6.3 Medium -
axiosRoot axios before 1.18.0 Prototype Pollution via bodyless methods 6.3 Medium -
axiosRoot axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 6.9 Medium -
axiosRoot axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 6.3 Medium -
axiosRoot axios before 1.18.0 Prototype Pollution via auth subfields 6.3 Medium -
axiosRoot axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON 6.3 Medium -
axiosRoot SNYK-JS-AXIOS-6144788 in @rootio/axios - Patched by Root No score -
axiosRoot SNYK-JS-AXIOS-6124857 in @rootio/axios - Patched by Root No score -
axiosRoot Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 7.5 High -
axiosRoot Axios: Allocation of Resources Without Limits or Throttling in axios 7.5 High -
axiosRoot Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 8.2 High -
axiosRoot Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 7.5 High -
axiosRoot CVE-2026-0000 in react-leaflet-heatmap-layer - Patched by Root No score -
axiosRoot Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 7.0 High -
axiosRoot Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` 8.7 High -
axiosRoot Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) 8.6 High -
axiosRoot Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 4.8 Medium -
axiosRoot Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix 3.7 Low -
axiosRoot Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking 7.4 High -
axiosRoot Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion 5.4 Medium -
axiosRoot Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 6.9 Medium -
axiosRoot Axios: HTTP adapter streamed responses bypass maxContentLength 5.3 Medium -
axiosRoot Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 5.3 Medium -
axiosRoot Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 5.3 Medium -
axiosRoot Axios: no_proxy bypass via IP alias allows SSRF 6.8 Medium -
axiosRoot Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy 4.8 Medium -
axiosRoot Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 7.2 High -
axiosRoot Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` 6.5 Medium -
axiosRoot Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 3.7 Low -
axiosRoot Axios: Header Injection via Prototype Pollution 7.4 High -
axiosRoot Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 7.4 High -
axiosRoot Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 4.8 Medium - Show olderLoading…