Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Axios: Prototype Pollution Gadget in axios toFormData Options

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

axios 0.28.0 before 0.33.0 Denial of Service via formToJSON

axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream

axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Allocation of Resources Without Limits or Throttling in axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios: no_proxy bypass via IP alias allows SSRF

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios is vulnerable to DoS attack through lack of data size check

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs

axios is vulnerable to Inefficient Regular Expression Complexity

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded

axios before 1.18.0 Prototype Pollution via bodyless methods

Axios: Header Injection via Prototype Pollution

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls