axios vulnerabilities (TuxCare)
54 vulnerabilities.
-
axiosTuxCare Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 6.9 Medium -
axiosTuxCare Axios: Prototype Pollution Gadget in axios toFormData Options 8.3 High -
axiosTuxCare Axios: Prototype pollution gadget in fetch adapter can alter outbound requests 6.9 Medium -
axiosTuxCare Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF 7.0 High -
axiosTuxCare Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location 8.2 High -
axiosTuxCare Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection 7.6 High -
axiosTuxCare Axios: Header Injection via Inherited headers After Minimal Interceptor 6.9 Medium -
axiosTuxCare Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) 8.2 High -
axiosTuxCare Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method 6.9 Medium -
axiosTuxCare Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization 8.2 High -
axiosTuxCare Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders 6.9 Medium -
axiosTuxCare Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls 7.0 High -
axiosTuxCare axios before 0.33.0 Prototype Pollution via nested option objects 6.3 Medium -
axiosTuxCare axios before 0.33.0 Prototype Pollution via Node HTTP adapter 8.3 High -
axiosTuxCare axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 6.9 Medium -
axiosTuxCare axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 6.3 Medium -
axiosTuxCare axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 6.3 Medium -
axiosTuxCare axios before 1.18.0 Prototype Pollution via bodyless methods 6.3 Medium -
axiosTuxCare axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 6.9 Medium -
axiosTuxCare axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 6.3 Medium -
axiosTuxCare axios before 1.18.0 Prototype Pollution via auth subfields 6.3 Medium -
axiosTuxCare axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON 6.3 Medium -
axiosTuxCare Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 7.5 High -
axiosTuxCare Axios: Allocation of Resources Without Limits or Throttling in axios 7.5 High -
axiosTuxCare Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 8.2 High -
axiosTuxCare Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 7.5 High -
axiosTuxCare Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 7.0 High -
axiosTuxCare Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` 8.7 High -
axiosTuxCare Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) 8.6 High -
axiosTuxCare Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 4.8 Medium -
axiosTuxCare Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix 3.7 Low -
axiosTuxCare Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking 7.4 High -
axiosTuxCare Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion 5.4 Medium -
axiosTuxCare Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 6.9 Medium -
axiosTuxCare Axios: HTTP adapter streamed responses bypass maxContentLength 5.3 Medium -
axiosTuxCare Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 5.3 Medium -
axiosTuxCare Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 5.3 Medium -
axiosTuxCare Axios: no_proxy bypass via IP alias allows SSRF 6.8 Medium -
axiosTuxCare Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy 4.8 Medium -
axiosTuxCare Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 7.2 High -
axiosTuxCare Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` 6.5 Medium -
axiosTuxCare Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 3.7 Low -
axiosTuxCare Axios: Header Injection via Prototype Pollution 7.4 High -
axiosTuxCare Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 7.4 High -
axiosTuxCare Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 4.8 Medium -
axiosTuxCare Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 6.3 Medium -
axiosTuxCare Axios affected by Denial of Service via __proto__ Key in mergeConfig 7.5 High -
axiosTuxCare Axios is vulnerable to DoS attack through lack of data size check 7.5 High -
axiosTuxCare Possible SSRF and Credential Leakage via Absolute URL in axios Requests 7.7 High -
axiosTuxCare Server-Side Request Forgery in axios 7.5 High - Show olderLoading…