Axios vulnerabilities
53 CVEs and advisories name Axios as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-101899Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
- CVE-2026-101909Axios: Prototype Pollution Gadget in axios toFormData Options
- CVE-2026-101908Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
- CVE-2026-101907Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
- CVE-2026-101906Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
- CVE-2026-101905Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
- CVE-2026-101904Axios: Header Injection via Inherited headers After Minimal Interceptor
- CVE-2026-101903Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
- CVE-2026-101902Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
- CVE-2026-101901Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
- CVE-2026-101900Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
- CVE-2026-101898Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
- CVE-2026-67321axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
- CVE-2026-67319axios before 0.33.0 Prototype Pollution via nested option objects
- CVE-2026-67318axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
- CVE-2026-67316axios before 1.18.0 Prototype Pollution via bodyless methods
- CVE-2026-67315axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
- CVE-2026-67312axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON
- CVE-2026-67320axios before 0.33.0 Prototype Pollution via Node HTTP adapter
- CVE-2026-67317axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
- CVE-2026-67314axios before 1.18.0 Prototype Pollution via auth subfields
- CVE-2026-67313axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
- CVE-2026-44486Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
- CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axios
- CVE-2026-44490Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
- CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
- CVE-2026-44495Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
- CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44489Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix