GHSA-m8m8-qj5v-23w3 high
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Affected range
SEMVER: introduced 1.15.2; fixed 1.20.0Fixed versions: 1.20.0
axios
Promise based HTTP client for the browser and node.js
npm latest 1.20.0 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
1.20.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
56 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-r4gj-5m52-g5wh high
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Affected range
SEMVER: introduced 1.17.0; fixed 1.20.0Fixed versions: 1.20.0
GHSA-3pq3-5fj3-cg6v high
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Affected range
SEMVER: introduced 1.13.0; fixed 1.20.0Fixed versions: 1.20.0
GHSA-c29m-xwm3-cm6r high
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Affected range
SEMVER: introduced 1.16.1; fixed 1.20.0Fixed versions: 1.20.0
GHSA-542g-h47m-68v8 high
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Affected range
SEMVER: introduced 1.13.0; fixed 1.20.0Fixed versions: 1.20.0
GHSA-x97p-jq2g-jp4f high
Axios: Prototype Pollution Gadget in axios toFormData Options
Affected range
SEMVER: introduced 0.28.0; fixed 0.34.0SEMVER: introduced 1.15.1; fixed 1.20.0Fixed versions: 0.34.0, 1.20.0
GHSA-mghh-pgcx-3jjj high
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Affected range
SEMVER: introduced 1.15.0; fixed 1.20.0Fixed versions: 1.20.0
GHSA-p92q-9vqr-4j8v high
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Affected range
SEMVER: introduced 1.0.0; fixed 1.16.0SEMVER: introduced 0; fixed 0.32.0Fixed versions: 1.16.0, 0.32.0
GHSA-pjwm-pj3p-43mv high
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Affected range
SEMVER: introduced 1.15.0; fixed 1.16.0SEMVER: introduced 0; fixed 0.32.0Fixed versions: 1.16.0, 0.32.0
GHSA-pmwg-cvhr-8vh7 high
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Affected range
SEMVER: introduced 1.0.0; fixed 1.15.1SEMVER: introduced 0; fixed 0.31.1Fixed versions: 1.15.1, 0.31.1
GHSA-pf86-5x62-jrwf high
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Affected range
SEMVER: introduced 1.0.0; fixed 1.15.1SEMVER: introduced 0; fixed 0.31.1Fixed versions: 1.15.1, 0.31.1
GHSA-6chq-wfr3-2hj9 high
Axios: Header Injection via Prototype Pollution
Affected range
SEMVER: introduced 1.0.0; fixed 1.15.1SEMVER: introduced 0; fixed 0.31.1Fixed versions: 1.15.1, 0.31.1
GHSA-3g43-6gmg-66jw high
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Affected range
SEMVER: introduced 1.0.0; fixed 1.15.2SEMVER: introduced 0.19.0; fixed 0.31.1Fixed versions: 1.15.2, 0.31.1
GHSA-35jp-ww65-95wh high
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Affected range
SEMVER: introduced 1.0.0; fixed 1.16.0Fixed versions: 1.16.0
GHSA-jr5f-v2jv-69x6 high
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
Affected range
SEMVER: introduced 1.0.0; fixed 1.8.2SEMVER: introduced 0; fixed 0.30.0Fixed versions: 1.8.2, 0.30.0
GHSA-q8qp-cvcw-x6jj high
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Affected range
SEMVER: introduced 1.0.0; fixed 1.15.2Fixed versions: 1.15.2
GHSA-gcfj-64vw-6mp9 high
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Affected range
SEMVER: introduced 0.31.1; fixed 0.33.0SEMVER: introduced 1.15.2; fixed 1.18.0Fixed versions: 0.33.0, 1.18.0
GHSA-j5f8-grm9-p9fc high
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Affected range
SEMVER: introduced 1.0.0; fixed 1.16.0SEMVER: introduced 0; fixed 0.32.0Fixed versions: 1.16.0, 0.32.0
GHSA-hfxv-24rg-xrqf high
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Affected range
SEMVER: introduced 1.0.0; fixed 1.16.0SEMVER: introduced 0; fixed 0.32.0Fixed versions: 1.16.0, 0.32.0
GHSA-777c-7fjr-54vf high
Allocation of Resources Without Limits or Throttling in Axios
Affected range
SEMVER: introduced 1.7.0; fixed 1.16.0Fixed versions: 1.16.0
GHSA-62hf-57xw-28j9 high
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Affected range
SEMVER: introduced 1.0.0; fixed 1.15.1SEMVER: introduced 0; fixed 0.31.1Fixed versions: 1.15.1, 0.31.1
GHSA-43fc-jf86-j433 high
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Affected range
SEMVER: introduced 1.0.0; fixed 1.13.5SEMVER: introduced 0; fixed 0.30.3Fixed versions: 1.13.5, 0.30.3
GHSA-4hjh-wcwx-xvwj high
Axios is vulnerable to DoS attack through lack of data size check
Affected range
SEMVER: introduced 1.0.0; fixed 1.12.0SEMVER: introduced 0.28.0; fixed 0.30.2Fixed versions: 1.12.0, 0.30.2
GHSA-8hc4-vh64-cxmj high
Server-Side Request Forgery in axios
Affected range
SEMVER: introduced 1.3.2; fixed 1.7.4Fixed versions: 1.7.4
GHSA-cph5-m8f7-6c5x high
axios Inefficient Regular Expression Complexity vulnerability
Affected range
SEMVER: introduced 0; fixed 0.21.2Fixed versions: 0.21.2
Show 31 more advisories
GHSA-42xw-2xvc-qx8m Denial of Service in axios
GHSA-j8rh-479h-cp32 Axios: Header Injection via Inherited headers After Minimal Interceptor
GHSA-4hqw-qxg8-jxx2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
GHSA-44g4-m2mj-wpvx Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
GHSA-vh66-26gq-q6x8 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
GHSA-9fr6-4gfg-395g Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
GHSA-xj6q-8x83-jv6g Axios: Prototype pollution auth subfields can inject Basic auth
GHSA-pmv8-rq9r-6j72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values
GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service
GHSA-xx6v-rp6x-q39c Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
GHSA-m7pr-hjqh-92cm Axios: no_proxy bypass via IP alias allows SSRF
GHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
GHSA-qj83-cq47-w5f8 Axios HTTP/2 Session Cleanup State Corruption Vulnerability
GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction
GHSA-jqh4-m9w3-8hp9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
GHSA-w9j2-pvgh-6h63 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
GHSA-vf2m-468p-8v99 Axios: HTTP adapter streamed responses bypass maxContentLength
GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
GHSA-3w6x-2g7m-8v23 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
GHSA-445q-vr5w-6q77 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
GHSA-fvcv-3m26-pcqx Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
GHSA-mwf2-3pr3-8698 Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
GHSA-wf5p-g6vw-rhxx Axios Cross-Site Request Forgery Vulnerability
GHSA-4w2v-q235-vp99 Axios vulnerable to Server-Side Request Forgery
GHSA-hcpx-6fm6-wx23 Axios form serializer maxDepth bypass via {} metatoken
GHSA-xhjh-pmcv-23jw Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
GHSA-654m-c8p4-x5fp Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
MAL-2026-2307 Malicious code in axios (npm)