CVE-2026-101905

The Axios HTTP client is vulnerable to a request socket hijack in versions 1.15.2 through 1.20.0 . The root cause lies in the Node HTTP adapter (lib/adapters/http.js), which fails to provide its own createConnection value. When combined with a separate same-process prototype-pollution flaw that p...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

PT-2026-99948

Name of the Vulnerable Software and Affected Versions Axios versions 1.15.2 through 1.19.x Description The Node HTTP adapter in lib/adapters/http.js provides request options that lack a specific createConnection value. When a separate prototype pollution flaw is present in the same process, an...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to Object.prototype.proxy being able to influence the Node HTTP adapter through an un-rehardened request configuration, allowing an attacker who can pollute the prototype to route requests through an attacker-controlled proxy...

Security Bulletin:Axios Prototype Pollution Vulnerability Fixed in Version 1.15.2

Summary Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser in the HTTP adapter are read via direct property access without hasOwnProperty guards,...

Node.js Module axios 0.31.1 < 0.33.0 / 1.15.2 < 1.18.0 Proxy Hijacking (CVE-2026-67320)

The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.2 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. Request...

Information Disclosure axios Dependency in Jira Service Management Data Center

This High severity Information Disclosure vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.5...

Information Disclosure axios Dependency in Jira Service Management Data Center

This High severity Information Disclosure vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.2...

Information Disclosure axios Dependency in Bitbucket Data Center

This High severity Information Disclosure vulnerability was introduced in versions 9.4.21, 10.2.4, and 10.3.1 of Bitbucket Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows ...

Information Disclosure axios Dependency in Crowd Data Center

This High severity Information Disclosure vulnerability was introduced in version 7.2.1 of Crowd Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows an unauthenticated attacke...

GHSA-68JP-44VC-2X5H Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references. Original Description axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios...

Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references. Original Description axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios...

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...