5520 matches found
CVE-2023-45857-Demo
Demo to verify the behavior of axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev on the app container 3. Access http://app.localhost 4. Verify that XSRF-TOKEN is set in the Cookie using the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false...
CVE-2022-0155-PoC
CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...
CVE-2023-45857-Demo
Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...
axios-ssrf
Get Started run pnpm install on the root, backend, and frontend directories run pnpm start:dev on the root directory Vulnerabilities This website is published on: https://axios-ssrf.onrender.com/ Server Side Request Forgery: I specifically used a version of axios that is vulnerable to SSRF attack...
axios-CVE-2025-27152-PoC
This repository does not have a README...
axios-redos
Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...
axios: Axios: Denial of Service via malformed data URLs
A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...
axios: Axios: Denial of Service via malformed data URLs
A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...
axios: Axios: Denial of Service via malformed data URLs
A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...
axios-supply-chain-cve-2026-26555
🔍 Vulnerability Research A curated collection of in-depth vulnerability writeups covering real-world security incidents in the software ecosystem. Each entry includes a full technical analysis, proof-of-concept, IOC listing, and remediation guidance. Purpose: Educational reference and portfolio...
CLSA-2026-1790889438 TuxCare security update for axios (2 CVEs)
TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.33.0-tuxcare.4...
audit-axios
audit-axios Scan local repos for vulnerable axios versions and patch interactively. Targets CVE-2026-40175 — CRLF Header Injection leading to Request Smuggling & SSRF. CVSS 9.9, affects all axios 1.15.0. Quick Start npx audit-axios /Workspace /Projects Usage Interactive — checkbox select + bulk...
CVE-2026-40175-poc
CVE-2026-40175 — Axios CRLF Injection / HTTP Request Smuggling PoC Overview A CRLF injection vulnerability caused by AxiosHeaders.set in the Axios HTTP client =1.0.0 =1.0.0 1.15.0, axios 0.31.0 Patched Versions| 1.15.0, 0.31.0 CWE| CWE-93 Improper Neutralization of CRLF Sequences Root Cause...
CLSA-2026-1790877131 TuxCare security update for axios (4 CVEs)
TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.27.2-tuxcare.6...
axios-security-guide
This repository does not have a README...
CVE-2026-40175
🚨 CVE-2026-40175 - Critical Vulnerability in Axios Prototype Pollution Gadget → Remote Code Execution & Cloud Compromise 📢 Overview Axios — one of the most popular HTTP clients for JavaScript browser & Node.js — contains a critical vulnerability prior to version 1.15.0. A specific "gadget" attack...
CLSA-2026-1790854830 TuxCare security update for axios (10 CVEs)
TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.18.1-tuxcare.1...
Security Bulletin: Vulnerabilities in Axios and Netty might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Axios and Netty. Vulnerabilities include Allowing attackers to reach sensitive loopback or internal services despite the configured protections, Prototype pollution in a third-party dependency may be leveraged...
NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor
NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor vulnerability discovered by ? in WordPress Npm axios versions = 1.0.0, 1.20.0...
