Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2025-62718)

Summary Axios is vulnerable to proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios-1.12.2.tgz (CVE-2026-25639, CVE-2026-39865)

Summary Axios is vulnerable to a Improper Check for Unusual or Exceptional Conditions Complete Denial of Service DoS, Uncontrolled Resource Consumption forcefully crashing the client application backend attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios-1.12.2.tgz (CVE-2026-25639)

Summary Immutable is vulnerable to a Denial of Service attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function i...

Denial Of Service (DoS)

axios is vulnerable to Denial of Service DoS. The vulnerability is due to an incomplete depth-limit bypass in toFormData.js when processing object keys ending in , which allows an attacker controlling object keys and nested values to trigger excessive recursion and a RangeError, causing the...

CVE-2026-77067

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/callwebhook.ts issues axios.request with that url, t...

CVE-2026-77067

Omnivore (open-source app) is vulnerable to a stored SSRF via the setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts. The resolver stores a caller-supplied URL without any address validation. When a subscribed event fires, callWebhook issues an axios.request to that URL with the r...

CVE-2026-77066 Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

CVE-2026-62681

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681

In Orval

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

Malicious Package

Overview axios-test-one is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-14246 Malicious code in hardhat-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...

PT-2026-78545

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...

CVE-2026-47719

FUXA SCADA/HMI software (versions before 1.3.2) exposes unauthenticated Socket.IO handlers DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY that accept attacker-controlled URLs and credentials, turning the server into a read-SSRF oracle capable of exfiltrating cloud metadata, internal services, OPC UA d...

ROOT-APP-NPM-CVE-2024-39338 CVE-2024-39338 in axios - Patched by Root

Root has patched CVE-2024-39338 in the axios package for Root:npm. Multiple fixed versions available...

MAL-2026-14029 Malicious code in axios-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...

Malicious code in axios-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installi...

axios lib/helpers/formDataToJSON.js Heap Buffer Overflow DoS

The vulnerability of the formDataToJSON function in the axios library’s lib/helpers/formDataToJSON.js file is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-19751

CVE-2026-19751 affects EnzoVezzaro mcp-dominican-layer (parse-csv tool). The flaw resides in src/index.ts, where axios.get is invoked with a manipulated csvUrl, enabling server-side request forgery. Exploitation is remote and a PoC exploit has been published. The project uses a rolling release st...