Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Priority HIGH 73CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 32 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00792 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.8.2axios (npm): 1.8.2, 0.30.0Red Hat: 32 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| axios | axios | before 1.8.2 | 1.8.2 | Patch available | CNA |
| — | axios (npm) | 1.0.0 to before 1.8.2 | 1.8.2 | Patch available | GHSA-jr5f-v2jv-69x6 |
| — | axios (npm) | before 0.30.0 | 0.30.0 | Patch available | GHSA-jr5f-v2jv-69x6 |
- axios Vendoraxios Affected before 1.8.2 Fixed in 1.8.2 Patch available CNA
- axios (npm) Vendor— Affected 1.0.0 to before 1.8.2 Fixed in 1.8.2 Patch available GHSA-jr5f-v2jv-69x6
- axios (npm) Vendor— Affected before 0.30.0 Fixed in 0.30.0 Patch available GHSA-jr5f-v2jv-69x6
Remediation
- Fix · CNA axios (axios) Fixed in 1.8.2
- Fix · GHSA-jr5f-v2jv-69x6 axios (npm) Fixed in 1.8.2 Advisory →
- Fix · GHSA-jr5f-v2jv-69x6 axios (npm) Fixed in 0.30.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27152
- 2026-10-03 Alias added: GHSA-jr5f-v2jv-69x6
- 2026-10-27 Affected versions changed · Red Hat
References
Other 6
- https://github.com/axios/axios/issues/6463
- https://github.com/axios/axios/pull/6829
- https://github.com/axios/axios/commit/02c3c69ced0f8fd86407c23203835892313d7fde
- https://github.com/axios/axios/commit/fb8eec214ce7744b5ca787f2c3b8339b2f54b00f
- https://github.com/axios/axios
- https://github.com/axios/axios/releases/tag/v1.8.2
More Axios vulnerabilities
- TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
- TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
- TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
- TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
- TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
- TI-2026-32424 Axios: Allocation of Resources Without Limits or Throttling in axios CVSS 3.1HIGH 7.5
Sources
- CVE-2025-27152 · CVE Program
- CVE-2025-27152 · NVD
- FIRST EPSS
- GHSA-jr5f-v2jv-69x6 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-27152 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences