TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
axios
Records56All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high25CVSS 7.0–8.9
Exploited now
axios records in CISA KEVNo axios vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
44 records in Axios · all components
TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv
Server-side request forgery in axios
Priority HIGH 76
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30578 CVE-2026-42264 · GHSA-q8qp-cvcw-x6jj
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Priority HIGH 74
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Priority HIGH 73
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-20009 CVE-2025-27152 · GHSA-jr5f-v2jv-69x6
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Priority HIGH 73
axios is a promise based HTTP client for the browser and node.js.
TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-36412 CVE-2025-58754 · GHSA-4hjh-wcwx-xvwj
Axios is vulnerable to DoS attack through lack of data size check
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-47617 CVE-2026-67321 · GHSA-hcpx-6fm6-wx23
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Priority HIGH 70
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32426 CVE-2026-44490 · GHSA-898c-q2cr-xwhg
Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2023-24614 CVE-2023-45857 · GHSA-wf5p-g6vw-rhxx
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN…
Priority HIGH 68
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensiti…
TI-2026-47614 CVE-2026-67318 · GHSA-mwf2-3pr3-8698
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
Priority HIGH 67
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2.
TI-2026-47609 CVE-2026-67313 · GHSA-42h9-826w-cgv3
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
Priority HIGH 67
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.
TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Priority HIGH 67
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30417 CVE-2026-42038 · GHSA-m7pr-hjqh-92cm
Axios: no_proxy bypass via IP alias allows SSRF
Priority HIGH 66
Axios is a promise based HTTP client for the browser and Node.js.
TI-2024-26292 CVE-2024-39338 · GHSA-8hc4-vh64-cxmj
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get…
Priority HIGH 66
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
TI-2026-30415 CVE-2026-42036 · GHSA-vf2m-468p-8v99
Axios: HTTP adapter streamed responses bypass maxContentLength
Priority MEDIUM 63
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30413 CVE-2026-42034 · GHSA-5c9x-8gcm-mpgx
Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
Priority MEDIUM 63
Axios is a promise based HTTP client for the browser and Node.js.