TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
axios
Records56All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high25CVSS 7.0–8.9
Exploited now
axios records in CISA KEVNo axios vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
56 records
TI-2026-65210 CVE-2026-101909 · GHSA-x97p-jq2g-jp4f
Axios: Prototype Pollution Gadget in axios toFormData Options
Priority HIGH 77
Axios is a promise-based HTTP client for the browser and Node.js.
TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv
Server-side request forgery in axios
Priority HIGH 76
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-65207 CVE-2026-101906 · GHSA-mghh-pgcx-3jjj
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Priority HIGH 75
Axios is a promise-based HTTP client for the browser and Node.js.
TI-2026-65202 CVE-2026-101901 · GHSA-542g-h47m-68v8
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Priority HIGH 75
Axios is a promise-based HTTP client for the browser and Node.js.
TI-2026-65206 CVE-2026-101905 · GHSA-m8m8-qj5v-23w3
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Priority HIGH 74
Axios is a promise-based HTTP client for the browser and Node.js.
TI-2026-30578 CVE-2026-42264 · GHSA-q8qp-cvcw-x6jj
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Priority HIGH 74
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Priority HIGH 73
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-20009 CVE-2025-27152 · GHSA-jr5f-v2jv-69x6
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Priority HIGH 73
axios is a promise based HTTP client for the browser and node.js.
TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-36412 CVE-2025-58754 · GHSA-4hjh-wcwx-xvwj
Axios is vulnerable to DoS attack through lack of data size check
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-65203 CVE-2026-101902 · GHSA-9fr6-4gfg-395g
Prototype pollution in axios
Priority HIGH 70
Axios is a promise-based HTTP client for the browser and Node.js.
TI-2026-47617 CVE-2026-67321 · GHSA-hcpx-6fm6-wx23
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Priority HIGH 70
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-65204 CVE-2026-101903 · GHSA-c29m-xwm3-cm6r
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Priority HIGH 69
Axios is a promise-based HTTP client for the browser and Node.js.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32426 CVE-2026-44490 · GHSA-898c-q2cr-xwhg
Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2023-24614 CVE-2023-45857 · GHSA-wf5p-g6vw-rhxx
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN…
Priority HIGH 68
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensiti…
TI-2026-47614 CVE-2026-67318 · GHSA-mwf2-3pr3-8698
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
Priority HIGH 67
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2.