axios: Axios: Denial of Service via malformed data URLs

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

axios: axios: Denial of Service via prototype pollution gadget in form serialization

A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: axios: Request socket hijacking via inherited createConnection property

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

axios: axios: Denial of Service via crafted redirect hostname

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

CLSA-2026-1790889438 TuxCare security update for axios (2 CVEs)

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.33.0-tuxcare.4...

CLSA-2026-1790877131 TuxCare security update for axios (4 CVEs)

TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.27.2-tuxcare.6...

CLSA-2026-1790854830 TuxCare security update for axios (10 CVEs)

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.18.1-tuxcare.1...

Prototype Pollution

axios is vulnerable to prototype pollution. The vulnerability is due to reading form‑serialization option properties without hasOwnProperty guards, where toFormData directly accesses visitor, maxDepth, dots, indexes, metaTokens, and Blob from an options object that may inherit polluted values fro...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to the fetch adapter passing the original fetchOptions to fetch instead of the sanitized resolvedOptions, where inherited Object.prototype.headers overrides the request headers, and an attacker who can pollute the prototype can...

Redirect Bypass

axios is vulnerable to redirect bypass. The vulnerability is due to the fetch adapter not honoring the maxRedirects option, where it constructs the fetch request without a redirect field—so the Fetch API defaults to redirect: 'follow'—and attackers can supply a redirecting URL to cause the reques...

Regular Expression Denial Of Service

Axios is vulnerable to a Regular Expression Denial Of Service. The vulnerability is due to quadratic backtracking in the regular expression used by shouldBypassProxy, where the pattern hostname.replace/\.+$/, '' scans a hostname composed of many dots followed by a non‑dot character, and an...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to the Node HTTP adapter not setting its own createConnection property, where the adapter supplies request options without an own createConnection value and Node resolves and invokes an inherited Object.prototype.createConnectio...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Object.prototype.headers during request configuration normalization, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled HTTP headers, including...

Regular Expression Denial Of Service

Axios is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to excessive regular-expression backtracking in DATAURLPATTERN when fromDataURI processes malformed data: URLs with many slash characters and no comma, allowing an attacker to block the Node.js event loop...