AX
Product
axios
56
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 5High 31Medium 18Low 2
Watch
Add axios to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42034 | 5.3 | Apr 24 | Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 Affected: >= 1.0.0, < 1.15.1; < 0.31.1 |
| CVE-2026-42037 | 5.3 | Apr 24 | Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream Affected: >= 1.0.0, < 1.15.1 |
| CVE-2025-27152 | 5.3 | Mar 7 | Possible SSRF and Credential Leakage via Absolute URL in axios Requests Affected: < 1.8.2 |
| CVE-2026-40175 | 4.8 | Apr 10 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Affected: >= 1.0.0, < 1.15.0; < 0.31.0 |
| CVE-2026-67319 | 3.7 | Aug 1 | axios before 0.33.0 Prototype Pollution via nested option objects Affected: 0.8.0 before 0.33.0; 1.0.0 before 1.18.0 |
| CVE-2026-42040 | 3.7 | Apr 24 | Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams Affected: >= 1.0.0, < 1.15.1; < 0.31.1 |