AX
Product
axios
56
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 5High 31Medium 18Low 2
Watch
Add axios to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-101899 | 6.9 | Oct 13 | Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges Affected: >= 1.15.0, < 1.20.0 |
| CVE-2026-101908 | 6.9 | Sep 28 | Axios: Prototype pollution gadget in fetch adapter can alter outbound requests Affected: >= 1.7.0, < 1.20.0 |
| CVE-2026-101904 | 6.9 | Sep 28 | Axios: Header Injection via Inherited headers After Minimal Interceptor Affected: >= 1.0.0, < 1.20.0 |
| CVE-2026-101902 | 6.9 | Sep 28 | Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method Affected: >= 1.0.0, < 1.20.0; >= 0.27.2, < 0.34.0 |
| CVE-2026-101900 | 6.9 | Sep 28 | Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders Affected: >= 1.12.0, < 1.20.0 |
| CVE-2026-67314 | 6.5 | Aug 1 | axios before 1.18.0 Prototype Pollution via auth subfields Affected: 1.15.2 before 1.18.0 |
| CVE-2026-42041 | 6.5 | Apr 24 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy Affected: >= 1.0.0, < 1.15.1; < 0.31.1 |
| CVE-2023-45857 | 6.5 | Nov 8 | An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to… Affected: 1.5.1 |
| CVE-2026-39865 | 5.9 | Apr 8 | Axios HTTP/2 Session Cleanup State Corruption Vulnerability Affected: >= 1.13.0, < 1.13.2 |
| CVE-2020-28168 | 5.9 | Nov 6 | Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect… Affected: 0.19.0 through 0.21.0 |
| CVE-2026-42042 | 5.4 | Apr 24 | Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion Affected: >= 1.0.0, < 1.15.1; < 0.31.1 |
| CVE-2026-67318 | 5.3 | Aug 1 | axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 Affected: 1.13.0 before 1.18.0 |
| CVE-2026-44489 | 5.3 | Jun 11 | Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix Affected: 1.15.2 |
| CVE-2026-42036 | 5.3 | Apr 24 | Axios: HTTP adapter streamed responses bypass maxContentLength Affected: >= 1.0.0, < 1.15.1; < 0.31.1 |
| CVE-2026-42034 | 5.3 | Apr 24 | Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 Affected: >= 1.0.0, < 1.15.1; < 0.31.1 |
| CVE-2026-42037 | 5.3 | Apr 24 | Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream Affected: >= 1.0.0, < 1.15.1 |
| CVE-2025-27152 | 5.3 | Mar 7 | Possible SSRF and Credential Leakage via Absolute URL in axios Requests Affected: < 1.8.2 |
| CVE-2026-40175 | 4.8 | Apr 10 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Affected: >= 1.0.0, < 1.15.0; < 0.31.0 |
Showing 18