Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mwf2-3pr3-8698. This link is maintained to preserve external references. Original Description axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request...

Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pmv8-rq9r-6j72. This link is maintained to preserve external references. Original Description axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSO...

Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42h9-826w-cgv3. This link is maintained to preserve external references. Original Description axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names...

GHSA-FQ2J-3J99-RX65 Duplicate Advisory: Axios: Excessive recursion in formDataToJSON can cause denial of service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42h9-826w-cgv3. This link is maintained to preserve external references. Original Description axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names...

GHSA-39J5-W47M-2GMV Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jqh4-m9w3-8hp9. This link is maintained to preserve external references. Original Description axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetc...

GHSA-4WW2-RJH2-XPV9 Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pmv8-rq9r-6j72. This link is maintained to preserve external references. Original Description axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSO...

GHSA-6HQM-HM2V-3P2P Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f4gw-2p7v-4548. This link is maintained to preserve external references. Original Description axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing...

GHSA-38GX-CFQF-F652 Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xj6q-8x83-jv6g. This link is maintained to preserve external references. Original Description axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling...

GHSA-FQJ3-H9PC-443H Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mwf2-3pr3-8698. This link is maintained to preserve external references. Original Description axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request...

Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f4gw-2p7v-4548. This link is maintained to preserve external references. Original Description axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing...

Duplicate Advisory: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jqh4-m9w3-8hp9. This link is maintained to preserve external references. Original Description axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetc...

axios: axios: Information disclosure and data manipulation via prototype pollution

A flaw was found in axios. When the JavaScript environment's Object.prototype has been previously compromised through a technique known as prototype pollution, axios can inadvertently use malicious properties from nested configuration objects. This can lead to the silent injection of unauthorized...

axios: axios: Information disclosure and data manipulation via prototype pollution

A flaw was found in axios. When the JavaScript environment's Object.prototype has been previously compromised through a technique known as prototype pollution, axios can inadvertently use malicious properties from nested configuration objects. This can lead to the silent injection of unauthorized...

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67312

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally when serializing FormData with Content-Type: application/json. When an application passes attacker-controlled FormData field names...

CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...