125 matches found
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...
Prototype Pollution
Axios is vulnerable to prototype pollution. The vulnerability is due to the fetch adapter passing the original fetchOptions to fetch instead of the sanitized resolvedOptions, where inherited Object.prototype.headers overrides the request headers, and an attacker who can pollute the prototype can...
Redirect Bypass
axios is vulnerable to redirect bypass. The vulnerability is due to the fetch adapter not honoring the maxRedirects option, where it constructs the fetch request without a redirect field—so the Fetch API defaults to redirect: 'follow'—and attackers can supply a redirecting URL to cause the reques...
NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...
EUVD-2026-88368
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders...
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...
GHSA-4HQW-QXG8-JXX2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...
GHSA-R4GJ-5M52-G5WH Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...
NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF vulnerability discovered by ? in WordPress Npm axios versions = 1.17.0, 1.20.0...