axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get…
Priority HIGH 66CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 13 fixed, 14 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01207 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (npm): 1.7.4Red Hat: 10 advisoriesRed Hat: 13 fixed, 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | axios (npm) | 1.3.2 to before 1.7.4 | 1.7.4 | Patch available | GHSA-8hc4-vh64-cxmj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- axios (npm) Vendor— Affected 1.3.2 to before 1.7.4 Fixed in 1.7.4 Patch available GHSA-8hc4-vh64-cxmj
Remediation
- Fix · GHSA-8hc4-vh64-cxmj axios (npm) Fixed in 1.7.4 Advisory →
Red Hat 10 advisories
- RHSA-2024:6122 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2024:8981 Released 2024-11-13 · Red Hat rating ImportantOpenShift Container Platform 4.17.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9
Show 7 more Red Hat advisories
- RHSA-2024:8014 Released 2024-10-22 · Red Hat rating ImportantNetwork Observability 1.7.0 for OpenShift
- NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:8023 Released 2024-10-14 · Red Hat rating ImportantRelease of OpenShift Serverless Logic 1.34.0 security update & enhancements
- 8Base-Openshift-Serverless-1.34 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +7
- RHSA-2024:7164 Released 2024-09-26 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.4 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8
- RHSA-2024:6667 Released 2024-09-12 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.16.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/configbump-rhel8, devspaces/dashboard-rhel8 +10
- RHSA-2024:6211 Released 2024-09-03 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.6.1 security update
- RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
- RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
- RHSA-2024:6210 Released 2024-09-03 · Red Hat rating LowRed Hat OpenShift Service Mesh Containers for 2.5.4 security update
- RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
- RHSA-2024:6209 Released 2024-09-03 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.4.10 security update
- RHOSSM 2.4 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Runtimes | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| 8Base-Openshift-Serverless-1.34 | Fixed | RHSA-2024:8023 |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:7164 |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| NETOBSERV 1.7 for RHEL 9 | Fixed | RHSA-2024:8014 |
| OpenShift Pipelines version 1.16 for RHEL 8 | Fixed | — |
| Quay v3 | Fixed | — |
| RHOSSM 2.4 for RHEL 8 | Fixed | RHSA-2024:6209 |
| RHOSSM 2.5 for RHEL 8 | Fixed | RHSA-2024:6210 |
| RHOSSM 2.6 for RHEL 8 | Fixed | RHSA-2024:6211 |
| RHOSSM 2.6 for RHEL 9 | Fixed | RHSA-2024:6211 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:8981 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2024:6122 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:6667 |
Not affected: 16 products
- 8Base-RHMTC-1.8
- Cryostat 3
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Applications 7
- Migration Toolkit for Virtualization
- Multicluster Engine for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39338
- 2026-10-03 Alias added: GHSA-8hc4-vh64-cxmj
- 2026-10-27 Affected versions changed · Red Hat
References
Other 7
- https://github.com/axios/axios/releases
- https://github.com/axios/axios/issues/6463
- https://github.com/axios/axios/pull/6539
- https://github.com/axios/axios/pull/6543
- https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a
- https://github.com/axios/axios
- https://github.com/axios/axios/releases/tag/v1.7.4
More Axios vulnerabilities
- TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
- TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
- TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
- TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
- TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
- TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
Sources
- CVE-2024-39338 · CVE Program
- CVE-2024-39338 · NVD
- FIRST EPSS
- GHSA-8hc4-vh64-cxmj · GitHub Advisory Database · CC BY 4.0
- CVE-2024-39338 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences