axios vulnerabilities (npm)
54 vulnerabilities.
-
axiosnpm Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 6.9 Medium -
axiosnpm Axios: Prototype Pollution Gadget in axios toFormData Options 8.3 High -
axiosnpm Axios: Prototype pollution gadget in fetch adapter can alter outbound requests 6.9 Medium -
axiosnpm Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF 7.0 High -
axiosnpm Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location 8.2 High -
axiosnpm Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection 7.6 High -
axiosnpm Axios: Header Injection via Inherited headers After Minimal Interceptor 6.9 Medium -
axiosnpm Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) 8.2 High -
axiosnpm Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method 6.9 Medium -
axiosnpm Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization 8.2 High -
axiosnpm Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders 6.9 Medium -
axiosnpm Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls 7.0 High -
axiosnpm axios before 0.33.0 Prototype Pollution via Node HTTP adapter 8.3 High -
axiosnpm axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 6.9 Medium -
axiosnpm axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 6.3 Medium -
axiosnpm axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 6.3 Medium -
axiosnpm axios before 1.18.0 Prototype Pollution via bodyless methods 6.3 Medium -
axiosnpm axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 6.9 Medium -
axiosnpm axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 6.3 Medium -
axiosnpm axios before 1.18.0 Prototype Pollution via auth subfields 6.3 Medium -
axiosnpm axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON 6.3 Medium -
axiosnpm Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 7.5 High -
axiosnpm Axios: Allocation of Resources Without Limits or Throttling in axios 7.5 High -
axiosnpm Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 8.2 High -
axiosnpm Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 7.5 High -
axiosnpm Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 7.0 High -
axiosnpm Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` 8.7 High -
axiosnpm Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) 8.6 High -
axiosnpm Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 4.8 Medium -
axiosnpm Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix 3.7 Low -
axiosnpm Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking 7.4 High -
axiosnpm Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion 5.4 Medium -
axiosnpm Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 6.9 Medium -
axiosnpm Axios: HTTP adapter streamed responses bypass maxContentLength 5.3 Medium -
axiosnpm Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 5.3 Medium -
axiosnpm Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 5.3 Medium -
axiosnpm Axios: no_proxy bypass via IP alias allows SSRF 6.8 Medium -
axiosnpm Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy 4.8 Medium -
axiosnpm Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 7.2 High -
axiosnpm Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` 6.5 Medium -
axiosnpm Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 3.7 Low -
axiosnpm Axios: Header Injection via Prototype Pollution 7.4 High -
axiosnpm Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 7.4 High -
axiosnpm Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain 4.8 Medium -
axiosnpm Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 6.3 Medium -
axiosnpm Axios HTTP/2 Session Cleanup State Corruption Vulnerability 5.9 Medium -
axiosnpm Axios affected by Denial of Service via __proto__ Key in mergeConfig 7.5 High -
axiosnpm Axios is vulnerable to DoS attack through lack of data size check 7.5 High -
axiosnpm Possible SSRF and Credential Leakage via Absolute URL in axios Requests 7.7 High -
axiosnpm Server-Side Request Forgery in axios 7.5 High - Show olderLoading…