- Latest release
- 1.21.0 (Oct 27, 2026): no advisory affects it
- Newest unaffected release
- 1.21.0 (Oct 27, 2026), the latest release
- Advisories
- 55 · 23 high, 27 medium, 2 low
- Weekly downloads
- 145.6M
- Dependents
- 173.9K
- Releases
- 147 since 0.1.0 (Aug 29, 2014)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-101899Affects 1.15.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101909Affects 0.28.0 to 0.33.0 (0.34.0 is outside it); 1.15.1 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101908Affects 1.7.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101907Affects 1.17.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101906Affects 1.15.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101905Affects 1.15.2 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101904Affects 1.0.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101903Affects 1.16.1 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101902Affects 0.27.2 to 0.33.0 (0.34.0 is outside it); 1.0.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101901Affects 1.13.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101900Affects 1.12.0 to 1.19.0 (1.20.0 is outside it)
- CVE-2026-101898Affects 1.13.0 to 1.19.0 (1.20.0 is outside it)
Show all 55 advisoriesShow fewer advisories
- CVE-2026-67321Affects 0.31.1 to 0.32.0 (0.33.0 is outside it); 1.15.1 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67319Affects 0.8.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67318Affects 1.13.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67316Affects 0.1.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67315Affects 0.31.0 to 0.32.0 (0.33.0 is outside it); 1.15.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67312Affects 0.28.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67320Affects 0.31.1 to 0.32.0 (0.33.0 is outside it); 1.15.2 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67317Affects 1.7.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67314Affects 1.15.2 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-67313Affects 0.28.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2026-44486Affects 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-44487Affects 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-44488Affects 1.7.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-44490Affects 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-44496Affects 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-44495Affects 0.19.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.1 (1.15.2 is outside it)
- CVE-2026-44494Affects 1.0.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-44489Affects 1.15.2 (1.16.0 is outside it)
- CVE-2026-44492Affects 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.15.0 to 1.15.2 (1.16.0 is outside it)
- CVE-2026-42264Affects 1.0.0 to 1.15.1 (1.15.2 is outside it)
- CVE-2026-42042Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42039Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42036Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42034Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42037Affects 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42038Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42041Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42043Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42044Affects 1.0.0 to 1.15.1 (1.15.2 is outside it)
- CVE-2026-42040Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42035Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-42033Affects 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it)
- CVE-2026-40175Affects 0.1.0 to 0.30.3 (0.31.0 is outside it); 1.0.0 to 1.14.0 (1.15.0 is outside it)
- CVE-2025-62718Affects 0.1.0 to 0.30.3 (0.31.0 is outside it); 1.0.0 to 1.14.0 (1.15.0 is outside it)
- CVE-2026-39865Affects 1.13.0 to 1.13.1 (1.13.2 is outside it)
- CVE-2026-25639Affects 0.1.0 to 0.30.2 (0.30.3 is outside it); 1.0.0 to 1.13.4 (1.13.5 is outside it)
- CVE-2025-58754Affects 0.28.0 to 0.30.1 (0.30.2 is outside it); 1.0.0 to 1.11.0 (1.12.0 is outside it)
- CVE-2025-27152Affects 0.1.0 to 0.29.0 (0.30.0 is outside it); 1.0.0 to 1.8.1 (1.8.2 is outside it)
- CVE-2024-39338Affects 1.3.2 to 1.7.3 (1.7.4 is outside it)
- CVE-2023-45857Affects 0.8.1 to 0.27.2 (0.28.0 is outside it); 1.0.0 to 1.5.1 (1.6.0 is outside it)
- CVE-2021-3749Affects 0.1.0 to 0.21.1 (0.21.2 is outside it)
- CVE-2020-28168Affects 0.1.0 to 0.21.0 (0.21.1 is outside it)
- CVE-2019-10742Affects 0.1.0 to 0.18.0 (0.18.1 is outside it)
Advisories 55
- CVE-2026-101899Medium 6.9
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Affected: from 1.15.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
20% of axios downloads last week were affected versions (33.4M).
- CVE-2026-101909High 8.3
Axios: Prototype Pollution Gadget in axios toFormData Options
Affected: from 0.28.0, fixed in 0.34.0; from 1.15.1, fixed in 1.20.0.
Fixed in 0.34.0 (released Sep 16, 2026, 12 days before disclosure) and 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
19% of axios downloads last week were affected versions (32.2M).
- CVE-2026-101908Medium 6.9
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Affected: from 1.7.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
45% of axios downloads last week were affected versions (76.7M).
- CVE-2026-101907High 7.0
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Affected: from 1.17.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
12% of axios downloads last week were affected versions (21.1M).
- CVE-2026-101906High 8.2
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Affected: from 1.15.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
20% of axios downloads last week were affected versions (33.4M).
- CVE-2026-101905High 7.6
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Affected: from 1.15.2, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
18% of axios downloads last week were affected versions (30.2M).
- CVE-2026-101904Medium 6.9
Axios: Header Injection via Inherited headers After Minimal Interceptor
Affected: from 1.0.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
48% of axios downloads last week were affected versions (81.7M).
- CVE-2026-101903High 8.2
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Affected: from 1.16.1, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
15% of axios downloads last week were affected versions (24.9M).
- CVE-2026-101902Medium 6.9
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Affected: from 0.27.2, fixed in 0.34.0; from 1.0.0, fixed in 1.20.0.
Fixed in 0.34.0 (released Sep 16, 2026, 12 days before disclosure) and 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
52% of axios downloads last week were affected versions (87.3M).
- CVE-2026-101901High 8.2
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Affected: from 1.13.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
31% of axios downloads last week were affected versions (51.8M).
- CVE-2026-101900Medium 6.9
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Affected: from 1.12.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
35% of axios downloads last week were affected versions (59.5M).
- CVE-2026-101898High 7.0
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Affected: from 1.13.0, fixed in 1.20.0.
Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure).
The latest release, 1.21.0, is not affected.
31% of axios downloads last week were affected versions (51.8M).
- CVE-2026-67321Medium 6.9
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Affected: from 0.31.1, fixed in 0.33.0; from 1.15.1, fixed in 1.18.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
7.4% of axios downloads last week were affected versions (12.5M).
- CVE-2026-67319Medium 6.3
axios before 0.33.0 Prototype Pollution via nested option objects
Affected: from 0.8.0, fixed in 0.33.0; from 1.0.0, fixed in 1.18.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
50% of axios downloads last week were affected versions (84.8M).
- CVE-2026-67318Medium 6.3
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
Affected: from 1.13.0, fixed in 1.18.0.
Fixed in 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
20% of axios downloads last week were affected versions (33.3M).
Show all 55 advisoriesShow fewer advisories
- CVE-2026-67316Medium 6.3
axios before 1.18.0 Prototype Pollution via bodyless methods
Affected: from 1.0.0, fixed in 1.18.0; fixed in 0.33.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
50% of axios downloads last week were affected versions (84.8M).
- CVE-2026-67315Medium 6.9
axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
Affected: from 1.15.0, fixed in 1.18.0; from 0.31.0, fixed in 0.33.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
9.1% of axios downloads last week were affected versions (15.4M).
- CVE-2026-67312Medium 6.3
axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON
Affected: from 0.28.0, fixed in 0.33.0; from 1.0.0, fixed in 1.18.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
38% of axios downloads last week were affected versions (64.4M).
- CVE-2026-67320High 8.3
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
Affected: from 0.31.1, fixed in 0.33.0; from 1.15.2, fixed in 1.18.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
7.2% of axios downloads last week were affected versions (12.1M).
- CVE-2026-67317Medium 6.3
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
Affected: from 1.7.0, fixed in 1.18.0.
Fixed in 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
34% of axios downloads last week were affected versions (58.3M).
- CVE-2026-67314Medium 6.3
axios before 1.18.0 Prototype Pollution via auth subfields
Affected: from 1.15.2, fixed in 1.18.0.
Fixed in 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
7% of axios downloads last week were affected versions (11.8M).
- CVE-2026-67313Medium 6.3
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
Affected: from 0.28.0, fixed in 0.33.0; from 1.0.0, fixed in 1.18.0.
Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure).
The latest release, 1.21.0, is not affected.
38% of axios downloads last week were affected versions (64.4M).
- CVE-2026-44486High 7.5
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0.
Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
44% of axios downloads last week were affected versions (74.6M).
- CVE-2026-44487High 8.2
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0.
Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
44% of axios downloads last week were affected versions (74.6M).
- CVE-2026-44488High 7.5
Axios: Allocation of Resources Without Limits or Throttling in axios
Affected: from 1.7.0, fixed in 1.16.0.
Fixed in 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
28% of axios downloads last week were affected versions (48.2M).
- CVE-2026-44490Medium 4.8
Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0.
Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
44% of axios downloads last week were affected versions (74.6M).
- CVE-2026-44496High 7.5
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0.
Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
44% of axios downloads last week were affected versions (74.6M).
- CVE-2026-44495High 7.0
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Affected: from 1.0.0, fixed in 1.15.2; from 0.19.0, fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 53 days before disclosure) and 1.15.2 (released Apr 21, 2026, 51 days before disclosure).
The latest release, 1.21.0, is not affected.
42% of axios downloads last week were affected versions (71.5M).
- CVE-2026-44494High 8.7
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Affected: from 1.0.0, fixed in 1.16.0.
Fixed in 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
31% of axios downloads last week were affected versions (53.2M).
- CVE-2026-44489Low 3.7
Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Affected: from 1.15.2, fixed in 1.16.0.
Fixed in 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
1% of axios downloads last week were affected versions (1.7M).
- CVE-2026-44492High 8.6
Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Affected: from 1.15.0, fixed in 1.16.0; fixed in 0.32.0.
Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure).
The latest release, 1.21.0, is not affected.
16% of axios downloads last week were affected versions (26.4M).
- CVE-2026-42264High 7.4
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Affected: from 1.0.0, fixed in 1.15.2.
Fixed in 1.15.2 (released Apr 21, 2026, 17 days before disclosure).
The latest release, 1.21.0, is not affected.
30% of axios downloads last week were affected versions (51.4M).
- CVE-2026-42042Medium 5.4
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42039Medium 6.9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42036Medium 5.3
Axios: HTTP adapter streamed responses bypass maxContentLength
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42034Medium 5.3
Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42037Medium 5.3
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Affected: from 1.0.0, fixed in 1.15.1.
Fixed in 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
30% of axios downloads last week were affected versions (51M).
- CVE-2026-42038Medium 6.8
Axios: no_proxy bypass via IP alias allows SSRF
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42041Medium 4.8
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42043High 7.2
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42044Medium 6.5
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Affected: from 1.0.0, fixed in 1.15.2.
Fixed in 1.15.2 (released Apr 21, 2026, 3 days before disclosure).
The latest release, 1.21.0, is not affected.
30% of axios downloads last week were affected versions (51.4M).
- CVE-2026-42040Low 3.7
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42035High 7.4
Axios: Header Injection via Prototype Pollution
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-42033High 7.4
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1.
Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure).
The latest release, 1.21.0, is not affected.
43% of axios downloads last week were affected versions (72.3M).
- CVE-2026-40175Medium 4.8
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Affected: from 1.0.0, fixed in 1.15.0; fixed in 0.31.0.
Fixed in 0.31.0 (released Apr 12, 2026, 2 days after disclosure) and 1.15.0 (released Apr 8, 2026, 2 days before disclosure).
The latest release, 1.21.0, is not affected.
41% of axios downloads last week were affected versions (69.4M).
- CVE-2025-62718Medium 6.3
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Affected: from 1.0.0, fixed in 1.15.0; fixed in 0.31.0.
Fixed in 0.31.0 (released Apr 12, 2026, 3 days after disclosure) and 1.15.0 (released Apr 8, 2026, 1 day before disclosure).
The latest release, 1.21.0, is not affected.
41% of axios downloads last week were affected versions (69.4M).
- CVE-2026-39865Medium 5.9
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Affected: from 1.13.0, fixed in 1.13.2.
Fixed in 1.13.2 (released Nov 4, 2025, 155 days before disclosure).
The latest release, 1.21.0, is not affected.
3.2% of axios downloads last week were affected versions (5.4M).
- CVE-2026-25639High 7.5
Axios affected by Denial of Service via proto Key in mergeConfig
Affected: from 1.0.0, fixed in 1.13.5; fixed in 0.30.3.
Fixed in 0.30.3 (released Feb 18, 2026, 9 days after disclosure) and 1.13.5 (released Feb 8, 2026, 1 day before disclosure).
The latest release, 1.21.0, is not affected.
37% of axios downloads last week were affected versions (62M).
- CVE-2025-58754High 7.5
Axios is vulnerable to DoS attack through lack of data size check
Affected: from 1.0.0, fixed in 1.12.0; from 0.28.0, fixed in 0.30.2.
Fixed in 0.30.2 (released Sep 27, 2025, 15 days after disclosure) and 1.12.0 (released Sep 11, 2025, 1 day before disclosure).
The latest release, 1.21.0, is not affected.
13% of axios downloads last week were affected versions (22.7M).
- CVE-2025-27152High 7.7
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Affected: from 1.0.0, fixed in 1.8.2; fixed in 0.30.0.
Fixed in 0.30.0 (released Mar 26, 2025, 19 days after disclosure) and 1.8.2 (released Mar 7, 2025, the day of disclosure).
The latest release, 1.21.0, is not affected.
19% of axios downloads last week were affected versions (32.6M).
- CVE-2024-39338Medium 4.0
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Affected: from 1.3.2, fixed in 1.7.4.
Fixed in 1.7.4 (released Aug 13, 2024, 4 days after disclosure).
The latest release, 1.21.0, is not affected.
3.4% of axios downloads last week were affected versions (5.8M).
- CVE-2023-45857Unrated
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header…
Affected: from 1.0.0, fixed in 1.6.0; from 0.8.1, fixed in 0.28.0.
Fixed in 0.28.0 (released Feb 12, 2024, 96 days after disclosure) and 1.6.0 (released Oct 26, 2023, 13 days before disclosure).
The latest release, 1.21.0, is not affected.
13% of axios downloads last week were affected versions (22.2M).
- CVE-2021-3749High 7.5
Inefficient Regular Expression Complexity in axios/axios
Affected: fixed in 0.21.2.
Fixed in 0.21.2 (released Sep 4, 2021, 4 days after disclosure).
The latest release, 1.21.0, is not affected.
2.2% of axios downloads last week were affected versions (3.8M).
- CVE-2020-28168Unrated
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by…
Affected: fixed in 0.21.1.
Fixed in 0.21.1 (released Dec 22, 2020, 46 days after disclosure).
The latest release, 1.21.0, is not affected.
1.7% of axios downloads last week were affected versions (2.9M).
- CVE-2019-10742Unrated
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content…
Affected: fixed in 0.18.1.
Fixed in 0.18.1 (released Jun 1, 2019, 25 days after disclosure).
The latest release, 1.21.0, is not affected.
0.3% of axios downloads last week were affected versions (501.9K).