axios vulnerabilities
Promise based HTTP client for the browser and node.js
- Registry
- npm
- Latest
- 1.20.0
- License
- MIT
56 known advisories
The latest version, 1.20.0, is not affected by any of them. Projects on older versions may be. Some versions were published with malicious code: remove them and rotate any secrets the install could read.
npm install axios@1.20.0Security advisories for axios
Axios: Header Injection via Inherited headers After Minimal Interceptor
- Affected
- >=1.0.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
- Affected
- >=1.12.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
- Affected
- >=1.15.2 <1.20.0
- Fixed in
- 1.20.0
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
- Affected
- >=1.15.0 <1.20.0
- Fixed in
- 1.20.0
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
- Affected
- >=1.17.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
- Affected
- >=1.7.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
- Affected
- >=0.27.2 <0.34.0 · >=1.0.0 <1.20.0
- Fixed in
- 0.34.0, 1.20.0
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
- Affected
- >=1.16.1 <1.20.0
- Fixed in
- 1.20.0
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
- Affected
- >=1.15.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype Pollution Gadget in axios toFormData Options
- Affected
- >=0.28.0 <0.34.0 · >=1.15.1 <1.20.0
- Fixed in
- 0.34.0, 1.20.0
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
- Affected
- >=1.13.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
- Affected
- >=1.13.0 <1.20.0
- Fixed in
- 1.20.0
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
- Affected
- >=0.31.1 <0.33.0 · >=1.15.2 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios form serializer maxDepth bypass via {} metatoken
- Affected
- >=0.31.1 <0.33.0 · >=1.15.1 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Nested axios option objects can consume polluted prototype values
- Affected
- >=0.8.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
- Affected
- >=1.13.0 <1.18.0
- Fixed in
- 1.18.0
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
- Affected
- >=1.7.0 <1.18.0
- Fixed in
- 1.18.0
Axios: Prototype pollution gadgets can alter axios request construction
- Affected
- >=1.0.0 <1.18.0 · <0.33.0
- Fixed in
- 0.33.0, 1.18.0
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
- Affected
- >=1.15.0 <1.18.0 · >=0.31.0 <0.33.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Excessive recursion in formDataToJSON can cause denial of service
- Affected
- >=0.28.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Prototype pollution auth subfields can inject Basic auth
- Affected
- >=1.15.2 <1.18.0
- Fixed in
- 1.18.0
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
- Affected
- >=0.28.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Allocation of Resources Without Limits or Throttling in Axios
- Affected
- >=1.7.0 <1.16.0
- Fixed in
- 1.16.0
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- Affected
- >=1.0.0 <1.15.2 · >=0.19.0 <0.31.1
- Fixed in
- 0.31.1, 1.15.2
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- Affected
- >=1.0.0 <1.16.0
- Fixed in
- 1.16.0
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- Affected
- >=1.15.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
- Affected
- >=1.15.2 <1.16.0
- Fixed in
- 1.16.0
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
- Affected
- >=1.0.0 <1.15.1
- Fixed in
- 1.15.1
Axios: no_proxy bypass via IP alias allows SSRF
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: HTTP adapter streamed responses bypass maxContentLength
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Header Injection via Prototype Pollution
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
- Affected
- >=1.0.0 <1.15.2
- Fixed in
- 1.15.2
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
- Affected
- >=1.0.0 <1.15.2
- Fixed in
- 1.15.2
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
- Affected
- >=1.0.0 <1.15.0 · <0.31.0
- Fixed in
- 0.31.0, 1.15.0
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- Affected
- >=1.0.0 <1.15.0 · <0.31.0
- Fixed in
- 0.31.0, 1.15.0
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
- Affected
- >=1.13.0 <1.13.2
- Fixed in
- 1.13.2
Malicious code in a published version
- Affected
- 0.30.4, 1.14.1
- Fixed in
- No fix released
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
- Affected
- >=1.0.0 <1.13.5 · <0.30.3
- Fixed in
- 0.30.3, 1.13.5
Axios is vulnerable to DoS attack through lack of data size check
- Affected
- >=1.0.0 <1.12.0 · >=0.28.0 <0.30.2
- Fixed in
- 0.30.2, 1.12.0
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
- Affected
- >=1.0.0 <1.8.2 · <0.30.0
- Fixed in
- 0.30.0, 1.8.2
Server-Side Request Forgery in axios
- Affected
- >=1.3.2 <1.7.4
- Fixed in
- 1.7.4
Axios Cross-Site Request Forgery Vulnerability
- Affected
- >=1.0.0 <1.6.0 · >=0.8.1 <0.28.0
- Fixed in
- 0.28.0, 1.6.0
axios Inefficient Regular Expression Complexity vulnerability
- Affected
- <0.21.2
- Fixed in
- 0.21.2
Axios vulnerable to Server-Side Request Forgery
- Affected
- <0.21.1
- Fixed in
- 0.21.1
Denial of Service in axios
- Affected
- <0.18.1
- Fixed in
- 0.18.1
Which of your client projects still run an old axios?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.