Skip to content
Axios vulnerabilities
Newest
-
axios
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
CVE-2026-101899
Fix available
6.9 Medium
-
axios
Axios: Prototype Pollution Gadget in axios toFormData Options
CVE-2026-101909
Fix available
8.3 High
-
axios
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
CVE-2026-101908
Fix available
6.9 Medium
-
axios
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
CVE-2026-101907
Fix available
7.0 High
-
axios
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
CVE-2026-101906
Fix available
8.2 High
-
axios
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
CVE-2026-101905
Fix available
7.6 High
-
axios
Axios: Header Injection via Inherited headers After Minimal Interceptor
CVE-2026-101904
Fix available
6.9 Medium
-
axios
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
CVE-2026-101903
Fix available
8.2 High
-
axios
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
CVE-2026-101902
Fix available
6.9 Medium
-
axios
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
CVE-2026-101901
Fix available
8.2 High
-
axios
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
CVE-2026-101900
Fix available
6.9 Medium
-
axios
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
CVE-2026-101898
Fix available
7.0 High
-
axios
axios before 0.33.0 Prototype Pollution via nested option objects
CVE-2026-67319
Fix available
6.3 Medium
-
axios
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
CVE-2026-67320
Fix available
8.3 High
-
axios
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
CVE-2026-67321
Fix available
6.9 Medium
-
axios
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
CVE-2026-67318
Fix available
6.3 Medium
-
axios
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
CVE-2026-67317
Fix available
6.3 Medium
-
axios
axios before 1.18.0 Prototype Pollution via bodyless methods
CVE-2026-67316
Fix available
6.3 Medium
-
axios
axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
CVE-2026-67315
Fix available
6.9 Medium
-
axios
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
CVE-2026-67313
Fix available
6.3 Medium
-
axios
axios before 1.18.0 Prototype Pollution via auth subfields
CVE-2026-67314
Fix available
6.3 Medium
-
axios
axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON
CVE-2026-67312
Fix available
6.3 Medium
-
axios, red hat cryostat 4, gatekeeper 3 +62 more +64 more
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
CVE-2026-44496
Fix available
7.5 High
-
axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more
Axios: Allocation of Resources Without Limits or Throttling in axios
CVE-2026-44488
Fix available
7.5 High
-
axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
CVE-2026-44487
Fix available
8.2 High
-
axios, red hat cryostat 4, gatekeeper 3 +63 more +65 more
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
CVE-2026-44486
Fix available
7.5 High
-
axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
CVE-2026-44495
Fix available
7.0 High
-
axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
CVE-2026-44494
Fix available
8.7 High
-
axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more
Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
CVE-2026-44492
Fix available
EPSS 12.3%
8.6 High
-
axios
Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
CVE-2026-44490
Fix available
4.8 Medium
-
axios
Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
CVE-2026-44489
Fix available
3.7 Low
-
axios, red hat cryostat 4, gatekeeper 3 +45 more +47 more
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
CVE-2026-42264
Fix available
7.4 High
-
axios
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
CVE-2026-42042
Fix available
5.4 Medium
-
axios, red hat cryostat 4, gatekeeper 3 +61 more +63 more
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
CVE-2026-42039
Fix available
6.9 Medium
-
axios
Axios: HTTP adapter streamed responses bypass maxContentLength
CVE-2026-42036
Fix available
5.3 Medium
-
axios
Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
CVE-2026-42034
Fix available
5.3 Medium
-
axios
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
CVE-2026-42037
Fix available
5.3 Medium
-
axios
Axios: no_proxy bypass via IP alias allows SSRF
CVE-2026-42038
Fix available
6.8 Medium
-
axios, red hat cryostat 4, gatekeeper 3 +57 more +59 more
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
CVE-2026-42041
Fix available
4.8 Medium
-
axios, red hat cryostat 4, gatekeeper 3 +56 more +58 more
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
CVE-2026-42043
Fix available
7.2 High
-
axios, red hat cryostat 4, gatekeeper 3 +59 more +61 more
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
CVE-2026-42044
Fix available
6.5 Medium
-
axios
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
CVE-2026-42040
Fix available
3.7 Low
-
axios
Axios: Header Injection via Prototype Pollution
CVE-2026-42035
Fix available
7.4 High
-
axios, red hat cryostat 4, gatekeeper 3 +57 more +59 more
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
CVE-2026-42033
Fix available
7.4 High
-
axios, red hat cryostat 4, gatekeeper 3 +63 more +65 more
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVE-2026-40175
Public exploitFix available
4.8 Medium
-
axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 more
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
CVE-2025-62718
Fix available
6.3 Medium
-
axios
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
CVE-2026-39865
Fix available
5.9 Medium
-
axios, red hat cryostat 4, gatekeeper 3 +63 more +65 more
Axios affected by Denial of Service via __proto__ Key in mergeConfig
CVE-2026-25639
Fix available
7.5 High
-
axios
Axios is vulnerable to DoS attack through lack of data size check
CVE-2025-58754
Fix available
7.5 High
-
axios
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
CVE-2025-27152
Public exploitFix available
7.7 High
- Show olderLoading…