5008 matches found
-fides-amor-et-lux (1.0.0), 0xppl-solana-portfolio (1.0.0) +12147 more potentially affected by CVE-2025-58754 via axios (>=1.0.0, <=1.11.0)
axios NPM version =1.0.0, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =2.0.0, =1.1.40, =0.0.2-beta.0, =2.1.0, =9.0.0-beta-bump-wagmi-viem.2 and more Source cves: CVE-2025-58754 Source advisory: OSV:GHSA-4HJH-WCWX-XVWJ...
GHSA-4HJH-WCWX-XVWJ Axios is vulnerable to DoS attack through lack of data size check
Summary When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory Buffer/Blob and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength which only protect HTTP...
PT-2025-37272
Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.11.0 Description Axios, a promise-based HTTP client for browsers and Node.js, is susceptible to a denial-of-service DoS attack when running on Node.js and processing URLs with the data: scheme. The Node http adapter...
-fides-amor-et-lux (1.0.0), 0xppl-solana-portfolio (1.0.0) +12147 more potentially affected by CVE-2025-58754 via axios (>=1.0.0, <=1.11.0)
axios NPM version =1.0.0, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =2.0.0, =1.1.40, =0.0.2-beta.0, =2.1.0, =9.0.0-beta-bump-wagmi-viem.2 and more Source cves: CVE-2025-58754 Source advisory: SNYK:JS-AXIOS-12613773...
Allocation of Resources Without Limits or Throttling
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with an excessive...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with a...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.bowergithub.axios:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.bower:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with...
Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks
Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft's Direct Send feature to form a "highly efficient attack pipeline" in recent phishing campaigns, according to new findings from ReliaQuest. "Axios user agent activity surged 241% from June to August 2025, dwarfin...
Malicious code in axios-npm-cosmiconfig-io (npm)
The package axios-npm-cosmiconfig-io was found to contain malicious code...
Malicious code in docusaurus-supervisor-eris-axios (npm)
The package docusaurus-supervisor-eris-axios was found to contain malicious code...
MAL-2025-46124 Malicious code in spectron-webdriver-axios-neptune-transport (npm)
The package spectron-webdriver-axios-neptune-transport was found to contain malicious code...
MAL-2025-44031 Malicious code in docusaurus-supervisor-eris-axios (npm)
The package docusaurus-supervisor-eris-axios was found to contain malicious code...
Malicious code in spectron-webdriver-axios-neptune-transport (npm)
The package spectron-webdriver-axios-neptune-transport was found to contain malicious code...
MAL-2025-43553 Malicious code in axios-npm-cosmiconfig-io (npm)
The package axios-npm-cosmiconfig-io was found to contain malicious code...
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
...
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
...
Security Bulletin: A vulnerability in axios may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2024-57965)
Summary There is a vulnerability in axios used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-57965 DESCRIPTION: In axios before 1.7.8,...
Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in axios-1.6.1.tgz
Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of axios-1.6.1.tgz Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to...
Security Bulletin: IBM Datapower Operations Dashboard could potentially cause SSRF and credential leakage CVE-2025-27152
Summary Axios is used by the IBM Datapower Operations Dashboard for HTTP requests to communicate with servers or APIs Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than...