Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3092 more potentially affected by CVE-2026-101907 via axios (>=1.17.0, <=1.19.0)

axios NPM version =1.17.0, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3092 more potentially affected by CVE-2026-101907 via axios (>=1.17.0, <=1.19.0)

axios NPM version =1.17.0, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...

EUVD-2026-88384

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF...

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF vulnerability discovered by ? in WordPress Npm axios versions = 1.17.0, 1.20.0...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +13595 more potentially affected by CVE-2026-101908 via axios (>=1.7.0, <=1.19.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-101908 Source advisory: GHSA-VH66-26GQ-Q6X8...

EUVD-2026-88387

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests...

GHSA-VH66-26GQ-Q6X8 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +13595 more potentially affected by CVE-2026-101908 via axios (>=1.7.0, <=1.19.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-101908 Source advisory: OSV:GHSA-VH66-26GQ-Q6X8...

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.20.0...

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

-price-checker (>=1.0.0, <=1.0.5), 01_use_npm (1.0.0) +22189 more potentially affected by CVE-2026-101902 via axios (>=0.27.2, <=0.33.0)

axios NPM version =0.27.2, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vector-search 0.1.0 - 0g-vibekit 0.1.0 and more Source cves: CVE-2026-101902 Source advisory: GHSA-9FR6-4GFG-395G...

GHSA-9FR6-4GFG-395G Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Summary Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request url and axios url can send a state-changing HTTP method instead...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101902 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101902 Source advisory: GHSA-9FR6-4GFG-395G...

NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

NPM: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method vulnerability discovered by ? in WordPress Npm axios versions = 0.27.2, 0.34.0...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101902 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101902 Source advisory: OSV:GHSA-9FR6-4GFG-395G...

EUVD-2026-88371

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method...

-price-checker (>=1.0.0, <=1.0.5), 01_use_npm (1.0.0) +22189 more potentially affected by CVE-2026-101902 via axios (>=0.27.2, <=0.33.0)

axios NPM version =0.27.2, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vector-search 0.1.0 - 0g-vibekit 0.1.0 and more Source cves: CVE-2026-101902 Source advisory: OSV:GHSA-9FR6-4GFG-395G...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3308 more potentially affected by CVE-2026-101903 via axios (>=1.16.1, <=1.19.0)

axios NPM version =1.16.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...