AX
Vendor
axios
56
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-101899 | AX axios axios | 6.9 | Oct 13 | Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges |
| CVE-2026-101909 | AX axios axios | 8.3 | Sep 28 | Axios: Prototype Pollution Gadget in axios toFormData Options |
| CVE-2026-101908 | AX axios axios | 6.9 | Sep 28 | Axios: Prototype pollution gadget in fetch adapter can alter outbound requests |
| CVE-2026-101907 | AX axios axios | 7.0 | Sep 28 | Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF |
| CVE-2026-101906 | AX axios axios | 8.2 | Sep 28 | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location |
| CVE-2026-101905 | AX axios axios | 7.6 | Sep 28 | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection |
| CVE-2026-101904 | AX axios axios | 6.9 | Sep 28 | Axios: Header Injection via Inherited headers After Minimal Interceptor |
| CVE-2026-101903 | AX axios axios | 8.2 | Sep 28 | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) |
| CVE-2026-101902 | AX axios axios | 6.9 | Sep 28 | Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method |
| CVE-2026-101901 | AX axios axios | 8.2 | Sep 28 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization |
| CVE-2026-101900 | AX axios axios | 6.9 | Sep 28 | Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders |
| CVE-2026-101898 | AX axios axios | 7.0 | Sep 28 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls |
| CVE-2026-67321 | AX axios axios | 7.5 | Aug 1 | axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass |
| CVE-2026-67319 | AX axios axios | 3.7 | Aug 1 | axios before 0.33.0 Prototype Pollution via nested option objects |
| CVE-2026-67318 | AX axios axios | 5.3 | Aug 1 | axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 |
| CVE-2026-67316 | AX axios axios | 7.4 | Aug 1 | axios before 1.18.0 Prototype Pollution via bodyless methods |
| CVE-2026-67315 | AX axios axios | 7.5 | Aug 1 | axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 |
| CVE-2026-67312 | AX axios axios | 7.5 | Aug 1 | axios 0.28.0 before 0.33.0 Denial of Service via formToJSON |
| CVE-2026-67320 | AX axios axios | 7.5 | Aug 1 | axios before 0.33.0 Prototype Pollution via Node HTTP adapter |
| CVE-2026-67317 | AX axios axios | 7.5 | Aug 1 | axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream |
| CVE-2026-67314 | AX axios axios | 6.5 | Aug 1 | axios before 1.18.0 Prototype Pollution via auth subfields |
| CVE-2026-67313 | AX axios axios | 7.5 | Aug 1 | axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON |
| CVE-2026-44486 | AX axios axios | 7.5 | Jun 11 | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
| CVE-2026-44487 | AX axios axios | 7.5 | Jun 11 | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
| CVE-2026-44488 | AX axios axios | 7.5 | Jun 11 | Axios: Allocation of Resources Without Limits or Throttling in axios |
| CVE-2026-44490 | AX axios axios | 8.2 | Jun 11 | Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions |
| CVE-2026-44496 | AX axios axios | 7.5 | Jun 11 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
| CVE-2026-44495 | AX axios axios | 7.7 | Jun 11 | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge |
| CVE-2026-44494 | AX axios axios | 8.7 | Jun 11 | Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| CVE-2026-44489 | AX axios axios | 5.3 | Jun 11 | Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix |
| CVE-2026-44492 | AX axios axios | 8.6 | Jun 11 | Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) |
| CVE-2026-42264 | AX axios axios | 9.1 | May 8 | Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking |
| CVE-2026-42042 | AX axios axios | 5.4 | Apr 24 | Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion |
| CVE-2026-42039 | AX axios axios | 7.5 | Apr 24 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
| CVE-2026-42036 | AX axios axios | 5.3 | Apr 24 | Axios: HTTP adapter streamed responses bypass maxContentLength |
| CVE-2026-42034 | AX axios axios | 5.3 | Apr 24 | Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 |
| CVE-2026-42037 | AX axios axios | 5.3 | Apr 24 | Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream |
| CVE-2026-42038 | AX axios axios | 7.5 | Apr 24 | Axios: no_proxy bypass via IP alias allows SSRF |
| CVE-2026-42041 | AX axios axios | 6.5 | Apr 24 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy |
| CVE-2026-42043 | AX axios axios | 10.0 | Apr 24 | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 |
| CVE-2026-42044 | AX axios axios | 9.1 | Apr 24 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` |
| CVE-2026-42040 | AX axios axios | 3.7 | Apr 24 | Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams |
| CVE-2026-42035 | AX axios axios | 7.4 | Apr 24 | Axios: Header Injection via Prototype Pollution |
| CVE-2026-42033 | AX axios axios | 7.4 | Apr 24 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking |
| CVE-2026-40175 | AX axios axios | 4.8 | Apr 10 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
| CVE-2025-62718 | AX axios axios | 9.9 | Apr 9 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
| CVE-2026-39865 | AX axios axios | 5.9 | Apr 8 | Axios HTTP/2 Session Cleanup State Corruption Vulnerability |
| CVE-2026-25639 | AX axios axios | 7.5 | Feb 9 | Axios affected by Denial of Service via __proto__ Key in mergeConfig |
| CVE-2025-58754 | AX axios axios | 7.5 | Sep 12 | Axios is vulnerable to DoS attack through lack of data size check |
| CVE-2025-27152 | AX Axios Axios | 5.3 | Mar 7 | axios is a promise based HTTP client for the browser and node.js |
| CVE-2024-57965 | AX Axios Axios | 9.8 | Jan 29 | In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call |
| CVE-2024-39338 | AX Axios Axios | 7.5 | Aug 12 | axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs |
| CVE-2023-45857 | AX Axios Axios | 6.5 | Nov 8 | An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to… |
| CVE-2021-3749 | AX Axios Axios | 7.5 | Aug 31 | axios is vulnerable to Inefficient Regular Expression Complexity |
| CVE-2020-28168 | AX Axios Axios | 5.9 | Nov 6 | Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect… |
| CVE-2019-10742 | AX Axios Axios | 7.5 | May 7 | Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded |