Is axios 0.24 vulnerable?
npm · 1 release from 0.24.0 to 0.24.0 · latest axios is 1.21.0 · checked 1 Nov 2026
Yes: 23 known advisories
Yes. axios 0.24.0, the last 0.24 release, is affected by 23 known security advisories (10 high, 12 medium, 1 low), including CVE-2026-44496, CVE-2026-44487, CVE-2026-44486. Upgrade to 0.33.0 or later to fix all of them.
npm install axios@0.33.0Advisories affecting axios 0.24.0
Axios: Nested axios option objects can consume polluted prototype values
- Affected
- >=0.8.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Prototype pollution gadgets can alter axios request construction
- Affected
- >=1.0.0 <1.18.0 · <0.33.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- Affected
- >=1.0.0 <1.15.2 · >=0.19.0 <0.31.1
- Fixed in
- 0.31.1, 1.15.2
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- Affected
- >=1.15.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: no_proxy bypass via IP alias allows SSRF
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: HTTP adapter streamed responses bypass maxContentLength
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Header Injection via Prototype Pollution
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
- Affected
- >=1.0.0 <1.15.0 · <0.31.0
- Fixed in
- 0.31.0, 1.15.0
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- Affected
- >=1.0.0 <1.15.0 · <0.31.0
- Fixed in
- 0.31.0, 1.15.0
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
- Affected
- >=1.0.0 <1.13.5 · <0.30.3
- Fixed in
- 0.30.3, 1.13.5
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
- Affected
- >=1.0.0 <1.8.2 · <0.30.0
- Fixed in
- 0.30.0, 1.8.2
Axios Cross-Site Request Forgery Vulnerability
- Affected
- >=1.0.0 <1.6.0 · >=0.8.1 <0.28.0
- Fixed in
- 0.28.0, 1.6.0
Which of your client projects are still on axios 0.24?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact axios version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other axios versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.