Prototype Pollution

axios is vulnerable to prototype‑pollution. The vulnerability is due to the default‑instance request code reading an inherited method value from Object.prototype, where the line config.method = config.method || this.defaults.method || 'get'.toLowerCase; falls back to this.defaults.method that can...

Denial Of Service

Axios is vulnerable to Denial Of Service. The vulnerability is due to Http2Sessions lacking adequate error handling for ClientHttp2Session errors during HTTP/2 session initialization or reuse, allowing an uncaught error to terminate the Node.js process...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Symbol.toStringTag, append, and getHeaders properties during FormData header resolution, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled...

Proxy Exclusion Bypass

Axios is vulnerable to Proxy Exclusion Bypass. The vulnerability is due to CIDR-form NOPROXY entries not being interpreted as IP ranges, allowing requests to internal IP addresses to bypass the intended proxy exclusion and be routed through the configured proxy...

Proxy And DNS Bypass

axios is vulnerable to Proxy and DNS bypass. The vulnerability is due to the HTTP/2 adapter not applying the caller‑supplied lookup function and proxy configuration, where the adapter builds the session with http2.connectauthority, http2Options using only the http2Options object and therefore omi...

dispatchRequest() function in the Security Bypass

The vulnerability of the dispatchRequest function in the axios library is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability can allow a remote attacker to bypass existing security mechanisms...

axios Heap Buffer Overflow DoS

The vulnerability of the axios.get function in the axios library’s lib/helpers/fromDataURI.js file is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

lib/helpers/Http2Sessions.js axios Bypass

The vulnerability of the lib/helpers/Http2Sessions.js file from the axios library is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms...

lib/adapters/http.js file in the Information Disclosure

The vulnerability of the lib/adapters/http.js file in the axios library is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by this security measure...

axios Http2Sessions Session Failure

The vulnerability of the Http2Sessions.getSession function in the axios library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

axios shouldBypassProxy function DoS

The vulnerability of the shouldBypassProxy function in the axios library’s lib/helpers/shouldBypassProxy.js file is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-101899

Axios supports proxy environment variables and evaluates "NOPROXY" exclusions in the Node.js adapter. CIDR-form "NOPROXY" entries such as "127.0.0.0/8", "10.0.0.0/8", or "169.254.169.254/32" are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusi...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101899 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

Security Bulletin: Vulnerabilities in Axios and Netty might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Axios and Netty. Vulnerabilities include Allowing attackers to reach sensitive loopback or internal services despite the configured protections, Prototype pollution in a third-party dependency may be leveraged...

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor vulnerability discovered by ? in WordPress Npm axios versions = 1.0.0, 1.20.0...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101904 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101904 Source advisory: OSV:GHSA-J8RH-479H-CP32...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101904 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101904 Source advisory: GHSA-J8RH-479H-CP32...

Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...

EUVD-2026-88380

Axios: Header Injection via Inherited headers After Minimal Interceptor...

GHSA-J8RH-479H-CP32 Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...