SSRF (Server-Side Request Forgery) axios Dependency in Crowd Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in version 7.2.2 of Crowd Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N allows an unauthenticated attacke...

axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to the fetch adapter passing the original fetchOptions to fetch instead of the sanitized resolvedOptions, where inherited Object.prototype.headers overrides the request headers, and an attacker who can pollute the prototype can...

Redirect Bypass

axios is vulnerable to redirect bypass. The vulnerability is due to the fetch adapter not honoring the maxRedirects option, where it constructs the fetch request without a redirect field—so the Fetch API defaults to redirect: 'follow'—and attackers can supply a redirecting URL to cause the reques...

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...

GHSA-4HQW-QXG8-JXX2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

EUVD-2026-88368

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders...

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...

GHSA-R4GJ-5M52-G5WH Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Summary Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect...

EUVD-2026-88384

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF...

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

NPM: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF vulnerability discovered by ? in WordPress Npm axios versions = 1.17.0, 1.20.0...