Is axios 1.15 vulnerable?
npm · 3 releases from 1.15.0 to 1.15.2 · latest axios is 1.21.0 · checked 1 Nov 2026
Yes: 28 known advisories
Yes. axios 1.15.2, the last 1.15 release, is affected by 28 known security advisories (12 high, 15 medium, 1 low), including CVE-2026-101905, CVE-2026-101906, CVE-2026-101909. 14 more affect earlier 1.15.x releases. Upgrade to 1.20.0 or later to fix all of them.
npm install axios@1.20.0Advisories affecting axios 1.15.2
Axios: Header Injection via Inherited headers After Minimal Interceptor
- Affected
- >=1.0.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
- Affected
- >=1.12.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
- Affected
- >=1.15.2 <1.20.0
- Fixed in
- 1.20.0
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
- Affected
- >=1.15.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
- Affected
- >=1.7.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
- Affected
- >=0.27.2 <0.34.0 · >=1.0.0 <1.20.0
- Fixed in
- 0.34.0, 1.20.0
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
- Affected
- >=1.15.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Prototype Pollution Gadget in axios toFormData Options
- Affected
- >=0.28.0 <0.34.0 · >=1.15.1 <1.20.0
- Fixed in
- 0.34.0, 1.20.0
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
- Affected
- >=1.13.0 <1.20.0
- Fixed in
- 1.20.0
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
- Affected
- >=1.13.0 <1.20.0
- Fixed in
- 1.20.0
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
- Affected
- >=0.31.1 <0.33.0 · >=1.15.2 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios form serializer maxDepth bypass via {} metatoken
- Affected
- >=0.31.1 <0.33.0 · >=1.15.1 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Nested axios option objects can consume polluted prototype values
- Affected
- >=0.8.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
- Affected
- >=1.13.0 <1.18.0
- Fixed in
- 1.18.0
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
- Affected
- >=1.7.0 <1.18.0
- Fixed in
- 1.18.0
Axios: Prototype pollution gadgets can alter axios request construction
- Affected
- >=1.0.0 <1.18.0 · <0.33.0
- Fixed in
- 0.33.0, 1.18.0
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
- Affected
- >=1.15.0 <1.18.0 · >=0.31.0 <0.33.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Excessive recursion in formDataToJSON can cause denial of service
- Affected
- >=0.28.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Prototype pollution auth subfields can inject Basic auth
- Affected
- >=1.15.2 <1.18.0
- Fixed in
- 1.18.0
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
- Affected
- >=0.28.0 <0.33.0 · >=1.0.0 <1.18.0
- Fixed in
- 0.33.0, 1.18.0
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Allocation of Resources Without Limits or Throttling in Axios
- Affected
- >=1.7.0 <1.16.0
- Fixed in
- 1.16.0
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- Affected
- >=1.0.0 <1.16.0
- Fixed in
- 1.16.0
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- Affected
- >=1.15.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- Affected
- >=1.0.0 <1.16.0 · <0.32.0
- Fixed in
- 0.32.0, 1.16.0
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
- Affected
- >=1.15.2 <1.16.0
- Fixed in
- 1.16.0
Fixed within 1.15.x, affecting earlier releases
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- Affected
- >=1.0.0 <1.15.2 · >=0.19.0 <0.31.1
- Fixed in
- 0.31.1, 1.15.2
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
- Affected
- >=1.0.0 <1.15.1
- Fixed in
- 1.15.1
Axios: no_proxy bypass via IP alias allows SSRF
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: HTTP adapter streamed responses bypass maxContentLength
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Header Injection via Prototype Pollution
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
- Affected
- >=1.0.0 <1.15.2
- Fixed in
- 1.15.2
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
- Affected
- >=1.0.0 <1.15.2
- Fixed in
- 1.15.2
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- Affected
- >=1.0.0 <1.15.1 · <0.31.1
- Fixed in
- 0.31.1, 1.15.1
Which of your client projects are still on axios 1.15?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact axios version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other axios versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.