# axios (npm) vulnerabilities 55 known vulnerabilities (23 high, 27 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.21.0 (Oct 27, 2026): no advisory affects it - Newest unaffected release: 1.21.0 (Oct 27, 2026), the latest release - Weekly downloads: 145.6M - Dependents: 173.9K - Releases: 147 since 0.1.0 (Aug 29, 2014) - Registry: https://www.npmjs.com/package/axios - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-101899: 1.15.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101909: 0.28.0 to 0.33.0 (0.34.0 is outside it); 1.15.1 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101908: 1.7.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101907: 1.17.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101906: 1.15.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101905: 1.15.2 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101904: 1.0.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101903: 1.16.1 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101902: 0.27.2 to 0.33.0 (0.34.0 is outside it); 1.0.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101901: 1.13.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101900: 1.12.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-101898: 1.13.0 to 1.19.0 (1.20.0 is outside it) - CVE-2026-67321: 0.31.1 to 0.32.0 (0.33.0 is outside it); 1.15.1 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67319: 0.8.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67318: 1.13.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67316: 0.1.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67315: 0.31.0 to 0.32.0 (0.33.0 is outside it); 1.15.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67312: 0.28.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67320: 0.31.1 to 0.32.0 (0.33.0 is outside it); 1.15.2 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67317: 1.7.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67314: 1.15.2 to 1.17.0 (1.18.0 is outside it) - CVE-2026-67313: 0.28.0 to 0.32.0 (0.33.0 is outside it); 1.0.0 to 1.17.0 (1.18.0 is outside it) - CVE-2026-44486: 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-44487: 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-44488: 1.7.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-44490: 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-44496: 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.0.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-44495: 0.19.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.1 (1.15.2 is outside it) - CVE-2026-44494: 1.0.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-44489: 1.15.2 (1.16.0 is outside it) - CVE-2026-44492: 0.1.0 to 0.31.1 (0.32.0 is outside it); 1.15.0 to 1.15.2 (1.16.0 is outside it) - CVE-2026-42264: 1.0.0 to 1.15.1 (1.15.2 is outside it) - CVE-2026-42042: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42039: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42036: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42034: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42037: 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42038: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42041: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42043: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42044: 1.0.0 to 1.15.1 (1.15.2 is outside it) - CVE-2026-42040: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42035: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-42033: 0.1.0 to 0.31.0 (0.31.1 is outside it); 1.0.0 to 1.15.0 (1.15.1 is outside it) - CVE-2026-40175: 0.1.0 to 0.30.3 (0.31.0 is outside it); 1.0.0 to 1.14.0 (1.15.0 is outside it) - CVE-2025-62718: 0.1.0 to 0.30.3 (0.31.0 is outside it); 1.0.0 to 1.14.0 (1.15.0 is outside it) - CVE-2026-39865: 1.13.0 to 1.13.1 (1.13.2 is outside it) - CVE-2026-25639: 0.1.0 to 0.30.2 (0.30.3 is outside it); 1.0.0 to 1.13.4 (1.13.5 is outside it) - CVE-2025-58754: 0.28.0 to 0.30.1 (0.30.2 is outside it); 1.0.0 to 1.11.0 (1.12.0 is outside it) - CVE-2025-27152: 0.1.0 to 0.29.0 (0.30.0 is outside it); 1.0.0 to 1.8.1 (1.8.2 is outside it) - CVE-2024-39338: 1.3.2 to 1.7.3 (1.7.4 is outside it) - CVE-2023-45857: 0.8.1 to 0.27.2 (0.28.0 is outside it); 1.0.0 to 1.5.1 (1.6.0 is outside it) - CVE-2021-3749: 0.1.0 to 0.21.1 (0.21.2 is outside it) - CVE-2020-28168: 0.1.0 to 0.21.0 (0.21.1 is outside it) - CVE-2019-10742: 0.1.0 to 0.18.0 (0.18.1 is outside it) ## Advisories (55) ### [CVE-2026-101899](https://cve.now/CVE-2026-101899): Axios: CIDR-form NO\_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges - Severity: Medium 6.9 - Published: Oct 13, 2026 - Affected: from 1.15.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 20% of axios downloads last week were affected versions (33.4M). ### [CVE-2026-101909](https://cve.now/CVE-2026-101909): Axios: Prototype Pollution Gadget in axios toFormData Options - Severity: High 8.3 - Published: Sep 28, 2026 - Affected: from 0.28.0, fixed in 0.34.0; from 1.15.1, fixed in 1.20.0. - Fixed in 0.34.0 (released Sep 16, 2026, 12 days before disclosure) and 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 19% of axios downloads last week were affected versions (32.2M). ### [CVE-2026-101908](https://cve.now/CVE-2026-101908): Axios: Prototype pollution gadget in fetch adapter can alter outbound requests - Severity: Medium 6.9 - Published: Sep 28, 2026 - Affected: from 1.7.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 45% of axios downloads last week were affected versions (76.7M). ### [CVE-2026-101907](https://cve.now/CVE-2026-101907): Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF - Severity: High 7.0 - Published: Sep 28, 2026 - Affected: from 1.17.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 12% of axios downloads last week were affected versions (21.1M). ### [CVE-2026-101906](https://cve.now/CVE-2026-101906): Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location - Severity: High 8.2 - Published: Sep 28, 2026 - Affected: from 1.15.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 20% of axios downloads last week were affected versions (33.4M). ### [CVE-2026-101905](https://cve.now/CVE-2026-101905): Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection - Severity: High 7.6 - Published: Sep 28, 2026 - Affected: from 1.15.2, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 18% of axios downloads last week were affected versions (30.2M). ### [CVE-2026-101904](https://cve.now/CVE-2026-101904): Axios: Header Injection via Inherited headers After Minimal Interceptor - Severity: Medium 6.9 - Published: Sep 28, 2026 - Affected: from 1.0.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 48% of axios downloads last week were affected versions (81.7M). ### [CVE-2026-101903](https://cve.now/CVE-2026-101903): Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) - Severity: High 8.2 - Published: Sep 28, 2026 - Affected: from 1.16.1, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 15% of axios downloads last week were affected versions (24.9M). ### [CVE-2026-101902](https://cve.now/CVE-2026-101902): Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method - Severity: Medium 6.9 - Published: Sep 28, 2026 - Affected: from 0.27.2, fixed in 0.34.0; from 1.0.0, fixed in 1.20.0. - Fixed in 0.34.0 (released Sep 16, 2026, 12 days before disclosure) and 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 52% of axios downloads last week were affected versions (87.3M). ### [CVE-2026-101901](https://cve.now/CVE-2026-101901): Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization - Severity: High 8.2 - Published: Sep 28, 2026 - Affected: from 1.13.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 31% of axios downloads last week were affected versions (51.8M). ### [CVE-2026-101900](https://cve.now/CVE-2026-101900): Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders - Severity: Medium 6.9 - Published: Sep 28, 2026 - Affected: from 1.12.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 35% of axios downloads last week were affected versions (59.5M). ### [CVE-2026-101898](https://cve.now/CVE-2026-101898): Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls - Severity: High 7.0 - Published: Sep 28, 2026 - Affected: from 1.13.0, fixed in 1.20.0. - Fixed in 1.20.0 (released Aug 26, 2026, 33 days before disclosure). - The latest release, 1.21.0, is not affected. - 31% of axios downloads last week were affected versions (51.8M). ### [CVE-2026-67321](https://cve.now/CVE-2026-67321): axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass - Severity: Medium 6.9 - Published: Aug 1, 2026 - Affected: from 0.31.1, fixed in 0.33.0; from 1.15.1, fixed in 1.18.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 7.4% of axios downloads last week were affected versions (12.5M). ### [CVE-2026-67319](https://cve.now/CVE-2026-67319): axios before 0.33.0 Prototype Pollution via nested option objects - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 0.8.0, fixed in 0.33.0; from 1.0.0, fixed in 1.18.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 50% of axios downloads last week were affected versions (84.8M). ### [CVE-2026-67318](https://cve.now/CVE-2026-67318): axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 1.13.0, fixed in 1.18.0. - Fixed in 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 20% of axios downloads last week were affected versions (33.3M). ### [CVE-2026-67316](https://cve.now/CVE-2026-67316): axios before 1.18.0 Prototype Pollution via bodyless methods - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 1.0.0, fixed in 1.18.0; fixed in 0.33.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 50% of axios downloads last week were affected versions (84.8M). ### [CVE-2026-67315](https://cve.now/CVE-2026-67315): axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO\_PROXY Bypass via 0.0.0.0 - Severity: Medium 6.9 - Published: Aug 1, 2026 - Affected: from 1.15.0, fixed in 1.18.0; from 0.31.0, fixed in 0.33.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 9.1% of axios downloads last week were affected versions (15.4M). ### [CVE-2026-67312](https://cve.now/CVE-2026-67312): axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 0.28.0, fixed in 0.33.0; from 1.0.0, fixed in 1.18.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 38% of axios downloads last week were affected versions (64.4M). ### [CVE-2026-67320](https://cve.now/CVE-2026-67320): axios before 0.33.0 Prototype Pollution via Node HTTP adapter - Severity: High 8.3 - Published: Aug 1, 2026 - Affected: from 0.31.1, fixed in 0.33.0; from 1.15.2, fixed in 1.18.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 7.2% of axios downloads last week were affected versions (12.1M). ### [CVE-2026-67317](https://cve.now/CVE-2026-67317): axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 1.7.0, fixed in 1.18.0. - Fixed in 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 34% of axios downloads last week were affected versions (58.3M). ### [CVE-2026-67314](https://cve.now/CVE-2026-67314): axios before 1.18.0 Prototype Pollution via auth subfields - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 1.15.2, fixed in 1.18.0. - Fixed in 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 7% of axios downloads last week were affected versions (11.8M). ### [CVE-2026-67313](https://cve.now/CVE-2026-67313): axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON - Severity: Medium 6.3 - Published: Aug 1, 2026 - Affected: from 0.28.0, fixed in 0.33.0; from 1.0.0, fixed in 1.18.0. - Fixed in 0.33.0 (released Jun 14, 2026, 48 days before disclosure) and 1.18.0 (released Jun 14, 2026, 48 days before disclosure). - The latest release, 1.21.0, is not affected. - 38% of axios downloads last week were affected versions (64.4M). ### [CVE-2026-44486](https://cve.now/CVE-2026-44486): Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection - Severity: High 7.5 - Published: Jun 11, 2026 - Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0. - Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 44% of axios downloads last week were affected versions (74.6M). ### [CVE-2026-44487](https://cve.now/CVE-2026-44487): Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - Severity: High 8.2 - Published: Jun 11, 2026 - Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0. - Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 44% of axios downloads last week were affected versions (74.6M). ### [CVE-2026-44488](https://cve.now/CVE-2026-44488): Axios: Allocation of Resources Without Limits or Throttling in axios - Severity: High 7.5 - Published: Jun 11, 2026 - Affected: from 1.7.0, fixed in 1.16.0. - Fixed in 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 28% of axios downloads last week were affected versions (48.2M). ### [CVE-2026-44490](https://cve.now/CVE-2026-44490): Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - Severity: Medium 4.8 - Published: Jun 11, 2026 - Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0. - Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 44% of axios downloads last week were affected versions (74.6M). ### [CVE-2026-44496](https://cve.now/CVE-2026-44496): Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - Severity: High 7.5 - Published: Jun 11, 2026 - Affected: from 1.0.0, fixed in 1.16.0; fixed in 0.32.0. - Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 44% of axios downloads last week were affected versions (74.6M). ### [CVE-2026-44495](https://cve.now/CVE-2026-44495): Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - Severity: High 7.0 - Published: Jun 11, 2026 - Affected: from 1.0.0, fixed in 1.15.2; from 0.19.0, fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 53 days before disclosure) and 1.15.2 (released Apr 21, 2026, 51 days before disclosure). - The latest release, 1.21.0, is not affected. - 42% of axios downloads last week were affected versions (71.5M). ### [CVE-2026-44494](https://cve.now/CVE-2026-44494): Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in \`config.proxy\` - Severity: High 8.7 - Published: Jun 11, 2026 - Affected: from 1.0.0, fixed in 1.16.0. - Fixed in 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 31% of axios downloads last week were affected versions (53.2M). ### [CVE-2026-44489](https://cve.now/CVE-2026-44489): Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - Severity: Low 3.7 - Published: Jun 11, 2026 - Affected: from 1.15.2, fixed in 1.16.0. - Fixed in 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 1% of axios downloads last week were affected versions (1.7M). ### [CVE-2026-44492](https://cve.now/CVE-2026-44492): Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO\_PROXY bypass (incomplete fix for CVE-2025-62718) - Severity: High 8.6 - Published: Jun 11, 2026 - Affected: from 1.15.0, fixed in 1.16.0; fixed in 0.32.0. - Fixed in 0.32.0 (released May 4, 2026, 38 days before disclosure) and 1.16.0 (released May 2, 2026, 40 days before disclosure). - The latest release, 1.21.0, is not affected. - 16% of axios downloads last week were affected versions (26.4M). ### [CVE-2026-42264](https://cve.now/CVE-2026-42264): Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking - Severity: High 7.4 - Published: May 8, 2026 - Affected: from 1.0.0, fixed in 1.15.2. - Fixed in 1.15.2 (released Apr 21, 2026, 17 days before disclosure). - The latest release, 1.21.0, is not affected. - 30% of axios downloads last week were affected versions (51.4M). ### [CVE-2026-42042](https://cve.now/CVE-2026-42042): Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in \`withXSRFToken\` Boolean Coercion - Severity: Medium 5.4 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42039](https://cve.now/CVE-2026-42039): Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - Severity: Medium 6.9 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42036](https://cve.now/CVE-2026-42036): Axios: HTTP adapter streamed responses bypass maxContentLength - Severity: Medium 5.3 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42034](https://cve.now/CVE-2026-42034): Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 - Severity: Medium 5.3 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42037](https://cve.now/CVE-2026-42037): Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream - Severity: Medium 5.3 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1. - Fixed in 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 30% of axios downloads last week were affected versions (51M). ### [CVE-2026-42038](https://cve.now/CVE-2026-42038): Axios: no\_proxy bypass via IP alias allows SSRF - Severity: Medium 6.8 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42041](https://cve.now/CVE-2026-42041): Axios: Authentication Bypass via Prototype Pollution Gadget in \`validateStatus\` Merge Strategy - Severity: Medium 4.8 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42043](https://cve.now/CVE-2026-42043): Axios: Incomplete Fix for CVE-2025-62718 — NO\_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 - Severity: High 7.2 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42044](https://cve.now/CVE-2026-42044): Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in \`parseReviver\` - Severity: Medium 6.5 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.2. - Fixed in 1.15.2 (released Apr 21, 2026, 3 days before disclosure). - The latest release, 1.21.0, is not affected. - 30% of axios downloads last week were affected versions (51.4M). ### [CVE-2026-42040](https://cve.now/CVE-2026-42040): Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams - Severity: Low 3.7 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42035](https://cve.now/CVE-2026-42035): Axios: Header Injection via Prototype Pollution - Severity: High 7.4 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-42033](https://cve.now/CVE-2026-42033): Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking - Severity: High 7.4 - Published: Apr 24, 2026 - Affected: from 1.0.0, fixed in 1.15.1; fixed in 0.31.1. - Fixed in 0.31.1 (released Apr 19, 2026, 5 days before disclosure) and 1.15.1 (released Apr 19, 2026, 5 days before disclosure). - The latest release, 1.21.0, is not affected. - 43% of axios downloads last week were affected versions (72.3M). ### [CVE-2026-40175](https://cve.now/CVE-2026-40175): Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - Severity: Medium 4.8 - Published: Apr 10, 2026 - Affected: from 1.0.0, fixed in 1.15.0; fixed in 0.31.0. - Fixed in 0.31.0 (released Apr 12, 2026, 2 days after disclosure) and 1.15.0 (released Apr 8, 2026, 2 days before disclosure). - The latest release, 1.21.0, is not affected. - 41% of axios downloads last week were affected versions (69.4M). ### [CVE-2025-62718](https://cve.now/CVE-2025-62718): Axios has a NO\_PROXY Hostname Normalization Bypass that Leads to SSRF - Severity: Medium 6.3 - Published: Apr 9, 2026 - Affected: from 1.0.0, fixed in 1.15.0; fixed in 0.31.0. - Fixed in 0.31.0 (released Apr 12, 2026, 3 days after disclosure) and 1.15.0 (released Apr 8, 2026, 1 day before disclosure). - The latest release, 1.21.0, is not affected. - 41% of axios downloads last week were affected versions (69.4M). ### [CVE-2026-39865](https://cve.now/CVE-2026-39865): Axios HTTP/2 Session Cleanup State Corruption Vulnerability - Severity: Medium 5.9 - Published: Apr 8, 2026 - Affected: from 1.13.0, fixed in 1.13.2. - Fixed in 1.13.2 (released Nov 4, 2025, 155 days before disclosure). - The latest release, 1.21.0, is not affected. - 3.2% of axios downloads last week were affected versions (5.4M). ### [CVE-2026-25639](https://cve.now/CVE-2026-25639): Axios affected by Denial of Service via proto Key in mergeConfig - Severity: High 7.5 - Published: Feb 9, 2026 - Affected: from 1.0.0, fixed in 1.13.5; fixed in 0.30.3. - Fixed in 0.30.3 (released Feb 18, 2026, 9 days after disclosure) and 1.13.5 (released Feb 8, 2026, 1 day before disclosure). - The latest release, 1.21.0, is not affected. - 37% of axios downloads last week were affected versions (62M). ### [CVE-2025-58754](https://cve.now/CVE-2025-58754): Axios is vulnerable to DoS attack through lack of data size check - Severity: High 7.5 - Published: Sep 12, 2025 - Affected: from 1.0.0, fixed in 1.12.0; from 0.28.0, fixed in 0.30.2. - Fixed in 0.30.2 (released Sep 27, 2025, 15 days after disclosure) and 1.12.0 (released Sep 11, 2025, 1 day before disclosure). - The latest release, 1.21.0, is not affected. - 13% of axios downloads last week were affected versions (22.7M). ### [CVE-2025-27152](https://cve.now/CVE-2025-27152): Possible SSRF and Credential Leakage via Absolute URL in axios Requests - Severity: High 7.7 - Published: Mar 7, 2025 - Affected: from 1.0.0, fixed in 1.8.2; fixed in 0.30.0. - Fixed in 0.30.0 (released Mar 26, 2025, 19 days after disclosure) and 1.8.2 (released Mar 7, 2025, the day of disclosure). - The latest release, 1.21.0, is not affected. - 19% of axios downloads last week were affected versions (32.6M). ### [CVE-2024-39338](https://cve.now/CVE-2024-39338): axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. - Severity: Medium 4.0 - Published: Aug 9, 2024 - Affected: from 1.3.2, fixed in 1.7.4. - Fixed in 1.7.4 (released Aug 13, 2024, 4 days after disclosure). - The latest release, 1.21.0, is not affected. - 3.4% of axios downloads last week were affected versions (5.8M). ### [CVE-2023-45857](https://cve.now/CVE-2023-45857): An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header… - Severity: Unrated - Published: Nov 8, 2023 - Affected: from 1.0.0, fixed in 1.6.0; from 0.8.1, fixed in 0.28.0. - Fixed in 0.28.0 (released Feb 12, 2024, 96 days after disclosure) and 1.6.0 (released Oct 26, 2023, 13 days before disclosure). - The latest release, 1.21.0, is not affected. - 13% of axios downloads last week were affected versions (22.2M). ### [CVE-2021-3749](https://cve.now/CVE-2021-3749): Inefficient Regular Expression Complexity in axios/axios - Severity: High 7.5 - Published: Aug 31, 2021 - Affected: fixed in 0.21.2. - Fixed in 0.21.2 (released Sep 4, 2021, 4 days after disclosure). - The latest release, 1.21.0, is not affected. - 2.2% of axios downloads last week were affected versions (3.8M). ### [CVE-2020-28168](https://cve.now/CVE-2020-28168): Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by… - Severity: Unrated - Published: Nov 6, 2020 - Affected: fixed in 0.21.1. - Fixed in 0.21.1 (released Dec 22, 2020, 46 days after disclosure). - The latest release, 1.21.0, is not affected. - 1.7% of axios downloads last week were affected versions (2.9M). ### [CVE-2019-10742](https://cve.now/CVE-2019-10742): Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content… - Severity: Unrated - Published: May 7, 2019 - Affected: fixed in 0.18.1. - Fixed in 0.18.1 (released Jun 1, 2019, 25 days after disclosure). - The latest release, 1.21.0, is not affected. - 0.3% of axios downloads last week were affected versions (501.9K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/axios Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.