-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +13595 more potentially affected by CVE-2026-101908 via axios (>=1.7.0, <=1.19.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-101908 Source advisory: MEND:CVE-2026-101908...

CVE-2026-101907 Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

CVE-2026-101907 Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

CVE-2026-101907 Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

CVE-2026-101907

The Axios promise-based HTTP client (versions 1.17.0 through 1.20.0 ) contains a vulnerability where the fetch adapter fails to enforce the maxRedirects: 0 policy. When an Axios request using this adapter receives a redirect response, the underlying fetch implementation follows the redirect inste...

CVE-2026-101907

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +13595 more potentially affected by CVE-2026-101907 via axios (>=1.7.0, <=1.19.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-101907 Source advisory: MEND:CVE-2026-101907...

CVE-2026-101907

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101906

The Axios promise-based HTTP client is vulnerable to a Regular Expression Denial of Service (ReDoS) affecting versions 1.15.0 through 1.20.0 . The root cause is a quadratic trailing-dot regular expression used within the shouldBypassProxy function during host normalization. When HTTP_PROXY/HTTPS_...

CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101906

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101906 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +564 more potentially affected by CVE-2026-101906 via axios (>=0.31.0, <=0.33.0)

axios NPM version =0.31.0, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =3.201.4, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2026-101906 Source advisory: MEND:CVE-2026-101906...

CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101906

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

The Axios HTTP client is vulnerable to a request socket hijack in versions 1.15.2 through 1.20.0 . The root cause lies in the Node HTTP adapter (lib/adapters/http.js), which fails to provide its own createConnection value. When combined with a separate same-process prototype-pollution flaw that p...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...