CVE-2026-101902

creationtimestamp| type| source ---|---|--- 2026-09-16 09:00:51+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g 2026-10-01 12:01:13+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwssq2pcdt2v...

CVE-2026-101903

creationtimestamp| type| source ---|---|--- 2026-09-16 09:00:09+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r 2026-09-29 07:31:20+00:00| seen|...

CVE-2026-101906

creationtimestamp| type| source ---|---|--- 2026-09-16 08:59:41+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj 2026-09-29 07:31:20+00:00| seen|...

CVE-2026-101909

creationtimestamp| type| source ---|---|--- 2026-09-16 08:59:17+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f 2026-09-29 07:31:20+00:00| seen|...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in axios (CVE-2025-62718)

Summary IBM Db2 Developer Extension is affected by vulnerability in axios CVE-2025-62718 Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization whe...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in axios - Patched by Root

Root has patched CVE-2026-44489 in the axios package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM MQ REST API and Console is vulnerable to multiple security issues

Summary IBM MQ has addressed multiple vulnerabilities in the axios HTTP client library used by the IBM MQ REST API and Console Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP...

ROOT-APP-NPM-CVE-2026-42040 CVE-2026-42040 in axios - Patched by Root

Root has patched CVE-2026-42040 in the axios package for Root:npm. Multiple fixed versions available...

PT-2026-98214

Root has patched GHSA-pmv8-rq9r-6j72 in the axios package for Root:npm. Multiple fixed versions available...

PT-2026-98210

Root has patched GHSA-42h9-826w-cgv3 in the axios package for Root:npm. Multiple fixed versions available...

PT-2026-98213

Root has patched GHSA-mmx7-hfxf-jppx in the axios package for Root:npm. Multiple fixed versions available...

PT-2026-98212

Root has patched GHSA-7q8q-rj6j-mhjq in the axios package for Root:npm. Multiple fixed versions available...

PT-2026-98211

Root has patched GHSA-68jp-44vc-2x5h in the axios package for Root:npm. Multiple fixed versions available...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization

A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NOPROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the...

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

axios: Axios: Information disclosure due to prototype pollution vulnerability

A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this...