Is axios 1.13 vulnerable?
npm · 7 releases from 1.13.0 to 1.13.6 · latest axios is 1.21.0 · checked 1 Nov 2026
Yes: 34 known advisories
Yes. axios 1.13.6, the last 1.13 release, is affected by 34 known security advisories (12 high, 21 medium, 1 low), including CVE-2026-101898, CVE-2026-101901, CVE-2026-44496. 2 more affect earlier 1.13.x releases. Upgrade to 1.20.0 or later to fix all of them.
npm install axios@1.20.0Advisories affecting axios 1.13.6
Axios: Header Injection via Inherited headers After Minimal Interceptor
- Affected
- >=1.0.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
- Affected
- >=1.12.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
- Affected
- >=1.7.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
- Affected
- >=0.27.2 <0.34.0 · >=1.0.0 <1.20.0
- Fixed in
- 0.34.0, 1.20.0
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
- Affected
- >=1.13.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
- Affected
- >=1.13.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Nested axios option objects can consume polluted prototype values
- Affected
- >=0.8.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
- Affected
- >=1.13.0 <1.18.0
- Fixed in
- 1.18.0
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
- Affected
- >=1.7.0 <1.18.0
- Fixed in
- 1.18.0
Axios: Prototype pollution gadgets can alter axios request construction
- Affected
- >=1.0.0 <1.18.0 · <0.33.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Excessive recursion in formDataToJSON can cause denial of service
- Affected
- >=0.28.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
- Affected
- >=0.28.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Allocation of Resources Without Limits or Throttling in Axios
- Affected
- >=1.7.0 <1.16.0
- Fixed in
- 1.16.0
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- Affected
- >=1.0.0 <1.15.2 · >=0.19.0 <0.31.1
- Fixed in
- 0.31.1, 1.15.2
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- Affected
- >=1.0.0 <1.16.0
- Fixed in
- 1.16.0
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
- Affected
- >=1.0.0 <1.15.1
- Fixed in
- 1.15.1
Axios: no_proxy bypass via IP alias allows SSRF
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: HTTP adapter streamed responses bypass maxContentLength
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Header Injection via Prototype Pollution
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
- Affected
- >=1.0.0 <1.15.2
- Fixed in
- 1.15.2
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
- Affected
- >=1.0.0 <1.15.2
- Fixed in
- 1.15.2
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
- Affected
- >=1.0.0 <1.15.0 · <0.31.0
- Fixed in
- 0.31.0, 1.15.0
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- Affected
- >=1.0.0 <1.15.0 · <0.31.0
- Fixed in
- 0.31.0, 1.15.0
Fixed within 1.13.x, affecting earlier releases
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
- Affected
- >=1.13.0 <1.13.2
- Fixed in
- 1.13.2
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
- Affected
- >=1.0.0 <1.13.5 · <0.30.3
- Fixed in
- 0.30.3, 1.13.5
Which of your client projects are still on axios 1.13?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact axios version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other axios versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.