Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Axios: Prototype Pollution Gadget in axios toFormData Options

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

axios 0.28.0 before 0.33.0 Denial of Service via formToJSON

axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream

axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios: no_proxy bypass via IP alias allows SSRF

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios is vulnerable to DoS attack through lack of data size check

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs

axios is vulnerable to Inefficient Regular Expression Complexity

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded

axios before 1.18.0 Prototype Pollution via bodyless methods

Axios: Header Injection via Prototype Pollution

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

axios before 1.18.0 Prototype Pollution via auth subfields

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to…

Axios HTTP/2 Session Cleanup State Corruption Vulnerability

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect…

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

Axios: HTTP adapter streamed responses bypass maxContentLength