Axios vulnerabilities
53 CVEs and advisories name Axios as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-44492Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-42264Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
- CVE-2026-42042Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
- CVE-2026-42039Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
- CVE-2026-42036Axios: HTTP adapter streamed responses bypass maxContentLength
- CVE-2026-42034Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
- CVE-2026-42037Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
- CVE-2026-42038Axios: no_proxy bypass via IP alias allows SSRF
- CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
- CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- CVE-2026-42044Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
- CVE-2026-42040Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- CVE-2026-42035Axios: Header Injection via Prototype Pollution
- CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
- CVE-2026-40175Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
- CVE-2025-62718Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- CVE-2026-39865Axios HTTP/2 Session Cleanup State Corruption Vulnerability
- CVE-2026-25639Axios affected by Denial of Service via __proto__ Key in mergeConfig
- CVE-2025-58754Axios is vulnerable to DoS attack through lack of data size check
- CVE-2025-27152Possible SSRF and Credential Leakage via Absolute URL in axios Requests
- CVE-2024-57965In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted s
- CVE-2021-3749Inefficient Regular Expression Complexity in axios/axios
- CVE-2019-10742Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after