axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization

A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NOPROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the...

axios: Axios: Information disclosure due to prototype pollution vulnerability

A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

axios: Axios: Information disclosure of proxy credentials via HTTP redirects

A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can...

MAL-2026-10852 Malicious code in @gocortexio/npmgremlinbox-typosquat-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09f5118144335d297ecc63d98cff64ac6cbe5f93b23bd892706478faf996db98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-67292

Name of the Vulnerable Software and Affected Versions axios versions 0.28.0 through 0.32.x axios versions 1.0.0 through 1.17.x Description Uncontrolled recursion exists in the formDataToJSON function, which is exposed as axios.formToJSON and used internally when serializing FormData with...

PT-2026-67299

Name of the Vulnerable Software and Affected Versions axios versions prior to 0.33.0 axios versions 1.x prior to 1.18.0 Description Axios can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has been polluted by another component. Whil...

PT-2026-67293

Name of the Vulnerable Software and Affected Versions axios versions 0.28.0 and later Description Uncontrolled recursion exists in the formDataToJSON function when processing FormData field names containing deeply nested bracket segments. An attacker can provide FormData with field names containi...

MAL-2026-10773 Malicious code in telemetry-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f21f282e7349c68d7ff17d0b5c452fb51c3bab106ffb6f56dc80f108c4b0800 The package's Control.plugin entry point calls PluginOptions, which fetches a binary payload from...

Malicious code in axios-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...

MAL-2026-10772 Malicious code in axios-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...

Malicious code in telemetry-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f21f282e7349c68d7ff17d0b5c452fb51c3bab106ffb6f56dc80f108c4b0800 The package's Control.plugin entry point calls PluginOptions, which fetches a binary payload from...

Malicious code in axios-test-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193 axios-test-one impersonates the real axios package: manifest reuses axios's description, repository URL https://github.com/axios/axios.git, and...

MAL-2026-10727 Malicious code in axios-test-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193 axios-test-one impersonates the real axios package: manifest reuses axios's description, repository URL https://github.com/axios/axios.git, and...

Malicious code in @vite-js/vui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89dd59b0cc2b2931e47b1822fa705eba41767d28ae89bce2e277254377dd9a0a Package publishes under @vite-js/vui while impersonating the official vite package: package.json sets author "Evan You", description "Native-ESM...

MAL-2026-10619 Malicious code in @vite-js/vui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89dd59b0cc2b2931e47b1822fa705eba41767d28ae89bce2e277254377dd9a0a Package publishes under @vite-js/vui while impersonating the official vite package: package.json sets author "Evan You", description "Native-ESM...