axios (npm)
Advisories
98
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.20.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install axios@1.20.0yarn
yarn add axios@1.20.0pnpm
pnpm add axios@1.20.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-44g4-m2mj-wpvx Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges |
Medium EPSS 0.51% |
>= 1.15.0, < 1.20.0 | 1.20.0 |
| GHSA-x97p-jq2g-jp4f Axios: Prototype Pollution Gadget in axios toFormData Options |
High EPSS 0.50% |
>= 0.28.0, < 0.34.0 | 0.34.0 |
| GHSA-x97p-jq2g-jp4f Axios: Prototype Pollution Gadget in axios toFormData Options |
High EPSS 0.50% |
>= 1.15.1, < 1.20.0 | 1.20.0 |
| GHSA-vh66-26gq-q6x8 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests |
Medium EPSS 0.47% |
>= 1.7.0, < 1.20.0 | 1.20.0 |
| GHSA-r4gj-5m52-g5wh Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF |
High EPSS 0.47% |
>= 1.17.0, < 1.20.0 | 1.20.0 |
| GHSA-mghh-pgcx-3jjj Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location |
High EPSS 0.46% |
>= 1.15.0, < 1.20.0 | 1.20.0 |
| GHSA-m8m8-qj5v-23w3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection |
High EPSS 0.42% |
>= 1.15.2, < 1.20.0 | 1.20.0 |
| GHSA-j8rh-479h-cp32 Axios: Header Injection via Inherited headers After Minimal Interceptor |
Medium EPSS 0.49% |
>= 1.0.0, < 1.20.0 | 1.20.0 |
| GHSA-c29m-xwm3-cm6r Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) |
High EPSS 0.44% |
>= 1.16.1, < 1.20.0 | 1.20.0 |
| GHSA-9fr6-4gfg-395g Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method |
Medium EPSS 0.41% |
>= 1.0.0, < 1.20.0 | 1.20.0 |
| GHSA-9fr6-4gfg-395g Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method |
Medium EPSS 0.41% |
>= 0.27.2, < 0.34.0 | 0.34.0 |
| GHSA-542g-h47m-68v8 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization |
High EPSS 0.54% |
>= 1.13.0, < 1.20.0 | 1.20.0 |
| GHSA-4hqw-qxg8-jxx2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders |
Medium EPSS 0.55% |
>= 1.12.0, < 1.20.0 | 1.20.0 |
| GHSA-3pq3-5fj3-cg6v Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls |
High EPSS 0.55% |
>= 1.13.0, < 1.20.0 | 1.20.0 |
| GHSA-3mcp-22mf-vrw3 Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken Withdrawn |
High | >= 1.15.1 | No fix yet |
| GHSA-68jp-44vc-2x5h Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning Withdrawn |
High | >= 1.15.2 | No fix yet |
| GHSA-9wx3-p993-35vp Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values Withdrawn |
Low | >= 1.0.0 | No fix yet |
| GHSA-39j5-w47m-2gmv Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` Withdrawn |
High | >= 1.7.0 | No fix yet |
| GHSA-f2r5-pqh9-r8f8 Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction Withdrawn |
Medium | all versions | No fix yet |
| GHSA-fq2j-3j99-rx65 Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service Withdrawn |
High | >= 1.0.0 | No fix yet |
| GHSA-fqj3-h9pc-443h Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength` Withdrawn |
Medium | >= 1.13.0 | No fix yet |
| GHSA-4ww2-rjh2-xpv9 Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service Withdrawn |
Medium | >= 1.0.0 | No fix yet |
| GHSA-38gx-cfqf-f652 Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth Withdrawn |
Medium | >= 1.15.2 | No fix yet |
| GHSA-6hqm-hm2v-3p2p Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios Withdrawn |
High | >= 1.0.0 | No fix yet |
| GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning |
High EPSS 0.52% |
>= 0.31.1, < 0.33.0 | 0.33.0 |
| GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning |
High EPSS 0.52% |
>= 1.15.2, < 1.18.0 | 1.18.0 |
| GHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatoken |
High EPSS 0.53% |
>= 1.15.1, < 1.18.0 | 1.18.0 |
| GHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatoken |
High EPSS 0.53% |
>= 0.31.1, < 0.33.0 | 0.33.0 |
| GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values |
Low EPSS 0.32% |
>= 0.8.0, < 0.33.0 | 0.33.0 |
| GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values |
Low EPSS 0.32% |
>= 1.0.0, < 1.18.0 | 1.18.0 |
| GHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength` |
Medium EPSS 0.62% |
>= 1.13.0, < 1.18.0 | 1.18.0 |
| GHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` |
High EPSS 0.60% |
>= 1.7.0, < 1.18.0 | 1.18.0 |
| GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction |
High EPSS 0.42% |
< 0.33.0 | 0.33.0 |
| GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction |
High EPSS 0.42% |
>= 1.0.0, < 1.18.0 | 1.18.0 |
| GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios |
High EPSS 0.46% |
>= 0.31.0, < 0.33.0 | 0.33.0 |
| GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios |
High EPSS 0.46% |
>= 1.15.0, < 1.18.0 | 1.18.0 |
| GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service |
High EPSS 0.52% |
>= 1.0.0, < 1.18.0 | 1.18.0 |
| GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service |
High EPSS 0.52% |
>= 0.28.0, < 0.33.0 | 0.33.0 |
| GHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic auth |
Medium EPSS 0.41% |
>= 1.15.2, < 1.18.0 | 1.18.0 |
| GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service |
High EPSS 0.52% |
>= 1.0.0, < 1.18.0 | 1.18.0 |
| GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service |
High EPSS 0.52% |
>= 0.28.0, < 0.33.0 | 0.33.0 |
| GHSA-hfxv-24rg-xrqf Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
High EPSS 5.41% |
< 0.32.0 | 0.32.0 |
| GHSA-hfxv-24rg-xrqf Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
High EPSS 5.41% |
>= 1.0.0, < 1.16.0 | 1.16.0 |
| GHSA-777c-7fjr-54vf Allocation of Resources Without Limits or Throttling in Axios |
High EPSS 0.67% |
>= 1.7.0, < 1.16.0 | 1.16.0 |
| GHSA-p92q-9vqr-4j8v Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
High EPSS 0.69% |
< 0.32.0 | 0.32.0 |
| GHSA-p92q-9vqr-4j8v Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
High EPSS 0.69% |
>= 1.0.0, < 1.16.0 | 1.16.0 |
| GHSA-j5f8-grm9-p9fc Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
High EPSS 0.55% |
< 0.32.0 | 0.32.0 |
| GHSA-j5f8-grm9-p9fc Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
High EPSS 0.55% |
>= 1.0.0, < 1.16.0 | 1.16.0 |
| GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
High EPSS 0.85% |
>= 1.0.0, < 1.15.2 | 1.15.2 |
| GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
High EPSS 0.85% |
>= 0.19.0, < 0.31.1 | 0.31.1 |
| GHSA-35jp-ww65-95wh axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
High EPSS 1.06% |
>= 1.0.0, < 1.16.0 | 1.16.0 |
| GHSA-pjwm-pj3p-43mv axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) |
High EPSS 12.28% |
< 0.32.0 | 0.32.0 |
| GHSA-pjwm-pj3p-43mv axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) |
High EPSS 12.28% |
>= 1.15.0, < 1.16.0 | 1.16.0 |
| GHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions |
High EPSS 0.33% |
< 0.32.0 | 0.32.0 |
| GHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions |
High EPSS 0.33% |
>= 1.0.0, < 1.16.0 | 1.16.0 |
| GHSA-654m-c8p4-x5fp Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix |
Medium EPSS 0.24% |
>= 1.15.2, < 1.16.0 | 1.16.0 |
| GHSA-q8qp-cvcw-x6jj Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking |
Critical EPSS 0.80% |
>= 1.0.0, < 1.15.2 | 1.15.2 |
| GHSA-3w6x-2g7m-8v23 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` |
Critical EPSS 0.62% |
>= 1.0.0, < 1.15.2 | 1.15.2 |
| GHSA-pmwg-cvhr-8vh7 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 |
Critical EPSS 0.71% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-pmwg-cvhr-8vh7 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 |
Critical EPSS 0.71% |
< 0.31.1 | 0.31.1 |
| GHSA-xx6v-rp6x-q39c Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion |
Medium EPSS 0.21% |
< 0.31.1 | 0.31.1 |
| GHSA-xx6v-rp6x-q39c Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion |
Medium EPSS 0.21% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-w9j2-pvgh-6h63 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy |
Medium EPSS 0.66% |
< 0.31.1 | 0.31.1 |
| GHSA-w9j2-pvgh-6h63 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy |
Medium EPSS 0.66% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-xhjh-pmcv-23jw Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams |
Low EPSS 0.22% |
< 0.31.1 | 0.31.1 |
| GHSA-xhjh-pmcv-23jw Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams |
Low EPSS 0.22% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-62hf-57xw-28j9 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
High EPSS 0.77% |
< 0.31.1 | 0.31.1 |
| GHSA-62hf-57xw-28j9 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
High EPSS 0.77% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-m7pr-hjqh-92cm Axios: no_proxy bypass via IP alias allows SSRF |
High EPSS 0.32% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-m7pr-hjqh-92cm Axios: no_proxy bypass via IP alias allows SSRF |
High EPSS 0.32% |
< 0.31.1 | 0.31.1 |
| GHSA-445q-vr5w-6q77 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream |
Medium EPSS 0.29% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-vf2m-468p-8v99 Axios: HTTP adapter streamed responses bypass maxContentLength |
Medium EPSS 0.33% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-vf2m-468p-8v99 Axios: HTTP adapter streamed responses bypass maxContentLength |
Medium EPSS 0.33% |
< 0.31.1 | 0.31.1 |
| GHSA-6chq-wfr3-2hj9 Axios: Header Injection via Prototype Pollution |
High EPSS 0.40% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-6chq-wfr3-2hj9 Axios: Header Injection via Prototype Pollution |
High EPSS 0.40% |
< 0.31.1 | 0.31.1 |
| GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 |
Medium EPSS 0.33% |
< 0.31.1 | 0.31.1 |
| GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 |
Medium EPSS 0.33% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-pf86-5x62-jrwf Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
High EPSS 0.87% |
>= 1.0.0, < 1.15.1 | 1.15.1 |
| GHSA-pf86-5x62-jrwf Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
High EPSS 0.87% |
< 0.31.1 | 0.31.1 |
| GHSA-fvcv-3m26-pcqx Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
Medium EPSS 1.95% |
>= 1.0.0, < 1.15.0 | 1.15.0 |
| GHSA-fvcv-3m26-pcqx Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
Medium EPSS 1.95% |
< 0.31.0 | 0.31.0 |
| GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
Critical EPSS 1.19% |
< 0.31.0 | 0.31.0 |
| GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
Critical EPSS 1.19% |
>= 1.0.0, < 1.15.0 | 1.15.0 |
| GHSA-qj83-cq47-w5f8 Axios HTTP/2 Session Cleanup State Corruption Vulnerability |
Medium EPSS 0.73% |
>= 1.13.0, < 1.13.2 | 1.13.2 |
| MAL-2026-2307 Malicious code in axios (npm) |
Not rated yet | No fix yet | |
| GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
High EPSS 2.80% |
>= 1.0.0, < 1.13.5 | 1.13.5 |
| GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig |
High EPSS 2.80% |
< 0.30.3 | 0.30.3 |
| GHSA-4hjh-wcwx-xvwj Axios is vulnerable to DoS attack through lack of data size check |
High EPSS 1.20% |
>= 1.0.0, < 1.12.0 | 1.12.0 |
| GHSA-4hjh-wcwx-xvwj Axios is vulnerable to DoS attack through lack of data size check |
High EPSS 1.20% |
>= 0.28.0, < 0.30.2 | 0.30.2 |
| GHSA-rm8p-cx58-hcvx Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data Withdrawn |
High | >= 1.10.0, < 1.11.0 | 1.11.0 |
| GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL |
Medium EPSS 0.79% |
>= 1.0.0, < 1.8.2 | 1.8.2 |
| GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL |
Medium EPSS 0.79% |
< 0.30.0 | 0.30.0 |
| GHSA-8hc4-vh64-cxmj Server-Side Request Forgery in axios |
High EPSS 1.21% |
>= 1.3.2, < 1.7.4 | 1.7.4 |
| GHSA-wf5p-g6vw-rhxx Axios Cross-Site Request Forgery Vulnerability |
Medium EPSS 0.73% |
>= 0.8.1, < 0.28.0 | 0.28.0 |
| GHSA-wf5p-g6vw-rhxx Axios Cross-Site Request Forgery Vulnerability |
Medium EPSS 0.73% |
>= 1.0.0, < 1.6.0 | 1.6.0 |
| GHSA-cph5-m8f7-6c5x axios Inefficient Regular Expression Complexity vulnerability |
High EPSS 8.52% |
< 0.21.2 | 0.21.2 |
| GHSA-4w2v-q235-vp99 Axios vulnerable to Server-Side Request Forgery |
Medium EPSS 2.36% |
< 0.21.1 | 0.21.1 |
| GHSA-42xw-2xvc-qx8m Denial of Service in axios |
High EPSS 6.14% |
< 0.18.1 | 0.18.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor