# cve.now: Axios

The newest entries naming Axios as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-101899](https://cve.now/CVE-2026-101899.md): Axios: CIDR-form NO\_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges (CVSS 6.9)
- [CVE-2026-101909](https://cve.now/CVE-2026-101909.md): Axios: Prototype Pollution Gadget in axios toFormData Options (CVSS 8.3)
- [CVE-2026-101908](https://cve.now/CVE-2026-101908.md): Axios: Prototype pollution gadget in fetch adapter can alter outbound requests (CVSS 6.9)
- [CVE-2026-101907](https://cve.now/CVE-2026-101907.md): Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF (CVSS 7.0)
- [CVE-2026-101906](https://cve.now/CVE-2026-101906.md): Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (CVSS 8.2)
- [CVE-2026-101905](https://cve.now/CVE-2026-101905.md): Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection (CVSS 7.6)
- [CVE-2026-101904](https://cve.now/CVE-2026-101904.md): Axios: Header Injection via Inherited headers After Minimal Interceptor (CVSS 6.9)
- [CVE-2026-101903](https://cve.now/CVE-2026-101903.md): Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (CVSS 8.2)
- [CVE-2026-101902](https://cve.now/CVE-2026-101902.md): Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method (CVSS 6.9)
- [CVE-2026-101901](https://cve.now/CVE-2026-101901.md): Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (CVSS 8.2)
- [CVE-2026-101900](https://cve.now/CVE-2026-101900.md): Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders (CVSS 6.9)
- [CVE-2026-101898](https://cve.now/CVE-2026-101898.md): Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls (CVSS 7.0)
- [CVE-2026-67321](https://cve.now/CVE-2026-67321.md): axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass (CVSS 6.9)
- [CVE-2026-67319](https://cve.now/CVE-2026-67319.md): axios before 0.33.0 Prototype Pollution via nested option objects (CVSS 6.3)
- [CVE-2026-67318](https://cve.now/CVE-2026-67318.md): axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 (CVSS 6.3)
- [CVE-2026-67316](https://cve.now/CVE-2026-67316.md): axios before 1.18.0 Prototype Pollution via bodyless methods (CVSS 6.3)
- [CVE-2026-67315](https://cve.now/CVE-2026-67315.md): axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO\_PROXY Bypass via 0.0.0.0 (CVSS 6.9)
- [CVE-2026-67312](https://cve.now/CVE-2026-67312.md): axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON (CVSS 6.3)
- [CVE-2026-67320](https://cve.now/CVE-2026-67320.md): axios before 0.33.0 Prototype Pollution via Node HTTP adapter (CVSS 8.3)
- [CVE-2026-67317](https://cve.now/CVE-2026-67317.md): axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream (CVSS 6.3)
- [CVE-2026-67314](https://cve.now/CVE-2026-67314.md): axios before 1.18.0 Prototype Pollution via auth subfields (CVSS 6.3)
- [CVE-2026-67313](https://cve.now/CVE-2026-67313.md): axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON (CVSS 6.3)
- [CVE-2026-44486](https://cve.now/CVE-2026-44486.md): Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection (CVSS 7.5)
- [CVE-2026-44487](https://cve.now/CVE-2026-44487.md): Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (CVSS 8.2)
- [CVE-2026-44488](https://cve.now/CVE-2026-44488.md): Axios: Allocation of Resources Without Limits or Throttling in axios (CVSS 7.5)
- [CVE-2026-44490](https://cve.now/CVE-2026-44490.md): Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions (CVSS 4.8)
- [CVE-2026-44496](https://cve.now/CVE-2026-44496.md): Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection (CVSS 7.5)
- [CVE-2026-44495](https://cve.now/CVE-2026-44495.md): Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.0)
- [CVE-2026-44494](https://cve.now/CVE-2026-44494.md): Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in \`config.proxy\` (CVSS 8.7)
- [CVE-2026-44489](https://cve.now/CVE-2026-44489.md): Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix (CVSS 3.7)
- [CVE-2026-44492](https://cve.now/CVE-2026-44492.md): Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO\_PROXY bypass (incomplete fix for CVE-2025-62718) (CVSS 8.6)
- [CVE-2026-42264](https://cve.now/CVE-2026-42264.md): Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking (CVSS 7.4)
- [CVE-2026-42042](https://cve.now/CVE-2026-42042.md): Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in \`withXSRFToken\` Boolean Coercion (CVSS 5.4)
- [CVE-2026-42039](https://cve.now/CVE-2026-42039.md): Axios: unbounded recursion in toFormData causes DoS via deeply nested request data (CVSS 6.9)
- [CVE-2026-42036](https://cve.now/CVE-2026-42036.md): Axios: HTTP adapter streamed responses bypass maxContentLength (CVSS 5.3)
- [CVE-2026-42034](https://cve.now/CVE-2026-42034.md): Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 (CVSS 5.3)
- [CVE-2026-42037](https://cve.now/CVE-2026-42037.md): Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream (CVSS 5.3)
- [CVE-2026-42038](https://cve.now/CVE-2026-42038.md): Axios: no\_proxy bypass via IP alias allows SSRF (CVSS 6.8)
- [CVE-2026-42041](https://cve.now/CVE-2026-42041.md): Axios: Authentication Bypass via Prototype Pollution Gadget in \`validateStatus\` Merge Strategy (CVSS 4.8)
- [CVE-2026-42043](https://cve.now/CVE-2026-42043.md): Axios: Incomplete Fix for CVE-2025-62718 — NO\_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 (CVSS 7.2)
- [CVE-2026-42044](https://cve.now/CVE-2026-42044.md): Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in \`parseReviver\` (CVSS 6.5)
- [CVE-2026-42040](https://cve.now/CVE-2026-42040.md): Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams (CVSS 3.7)
- [CVE-2026-42035](https://cve.now/CVE-2026-42035.md): Axios: Header Injection via Prototype Pollution (CVSS 7.4)
- [CVE-2026-42033](https://cve.now/CVE-2026-42033.md): Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking (CVSS 7.4)
- [CVE-2026-40175](https://cve.now/CVE-2026-40175.md): Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (CVSS 4.8)
- [CVE-2025-62718](https://cve.now/CVE-2025-62718.md): Axios has a NO\_PROXY Hostname Normalization Bypass that Leads to SSRF (CVSS 6.3)
- [CVE-2026-39865](https://cve.now/CVE-2026-39865.md): Axios HTTP/2 Session Cleanup State Corruption Vulnerability (CVSS 5.9)
- [CVE-2026-25639](https://cve.now/CVE-2026-25639.md): Axios affected by Denial of Service via \_\_proto\_\_ Key in mergeConfig (CVSS 7.5)
- [CVE-2025-58754](https://cve.now/CVE-2025-58754.md): Axios is vulnerable to DoS attack through lack of data size check (CVSS 7.5)
- [CVE-2025-27152](https://cve.now/CVE-2025-27152.md): Possible SSRF and Credential Leakage via Absolute URL in axios Requests (CVSS 7.7)
- [CVE-2024-57965](https://cve.now/CVE-2024-57965.md): In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted s (CVSS 0.0)
- [CVE-2021-3749](https://cve.now/CVE-2021-3749.md): Inefficient Regular Expression Complexity in axios/axios (CVSS 7.5)
- [CVE-2019-10742](https://cve.now/CVE-2019-10742.md): Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/axios
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.