axios: Axios: Denial of Service via malformed data URLs

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

axios: Axios: Denial of Service via malformed data URLs

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

axios: Axios: Denial of Service via malformed data URLs

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

axios-supply-chain-cve-2026-26555

🔍 脆弱性リサーチ ソフトウェアエコシステムにおける実際のセキュリティインシデントを扱った、厳選された詳細な脆弱性ライトアップのコレクションです。各エントリには、完全な技術分析、概念実証（PoC）、IOCリスト、および修復ガイダンスが含まれています。 目的： 教育用リファレンスおよびポートフォリオです。すべてのPoCコードは検出および研究のみを目的としています。 目次 | 脆弱性| 種別| 深刻度| 日付| ステータス ---|---|---|---|---|--- 001| Axios npm サプライチェーン攻撃 CVE-2026-26555| サプライチェーン / RAT| 🚨...

CLSA-2026-1790889438 TuxCare security update for axios (2 CVEs)

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.33.0-tuxcare.4...

audit-axios

audit-axios 扫描本地仓库中易受攻击的 axios 版本，并以交互方式修补。 针对 CVE-2026-40175 — CRLF 头注入，可导致请求走私与 SSRF。CVSS 9.9，影响所有 axios 1.15.0 版本。 快速开始 npx audit-axios /Workspace /Projects 用法 交互式 — 复选框选择 + 批量操作 audit-axios /Workspace /Projects 仅扫描（适合 CI，存在漏洞时退出码为 1） audit-axios --scan-only /Workspace 自动修补所有内容 audit-axios...

CVE-2026-40175-poc

CVE-2026-40175 — Axios CRLF 注入 / HTTP 请求走私 PoC 概述 Axios HTTP 客户端（=1.0.0 =1.0.0 1.15.0、axios 0.31.0 修复版本| 1.15.0、0.31.0 CWE| CWE-93 CRLF 序列的不当中和 根本原因 lib/core/AxiosHeaders.js AxiosHeaders.set └─ normalizeValue └─ 仅通过 /\r\n+$/ 移除尾部 CRLF ↑ 值中间的 \r\n 原样通过 因此，若在头值中插入 \r\n\r\nGET /admin HTTP/1.1\r\n......

CLSA-2026-1790877131 TuxCare security update for axios (4 CVEs)

TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.27.2-tuxcare.6...

axios-security-guide

此存储库没有 README。...

CVE-2026-40175

🚨 CVE-2026-40175 - Axios の重大な脆弱性 プロトタイプ汚染ガジェット → リモートコード実行 & クラウド侵害 📢 概要 Axios は、JavaScript（ブラウザ & Node.js）向けの最も人気のある HTTP クライアントの 1 つですが、バージョン 1.15.0 より前には 重大な 脆弱性が存在します。 特定の 「ガジェット」攻撃チェーン により、攻撃者は あらゆるプロトタイプ汚染 （サードパーティの依存関係由来のものも含む）を次のように昇格させることができます： リモートコード実行（RCE） 完全なクラウド侵害 （AWS IMDSv2...

CLSA-2026-1790854830 TuxCare security update for axios (10 CVEs)

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.18.1-tuxcare.1...

Security Bulletin: Vulnerabilities in Axios and Netty might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Axios and Netty. Vulnerabilities include Allowing attackers to reach sensitive loopback or internal services despite the configured protections, Prototype pollution in a third-party dependency may be leveraged...

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor

NPM: Axios: Header Injection via Inherited headers After Minimal Interceptor vulnerability discovered by ? in WordPress Npm axios versions = 1.0.0, 1.20.0...

Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...

EUVD-2026-88380

Axios: Header Injection via Inherited headers After Minimal Interceptor...

GHSA-J8RH-479H-CP32 Axios: Header Injection via Inherited headers After Minimal Interceptor

Summary Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability...

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...

GHSA-4HQW-QXG8-JXX2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

EUVD-2026-88368

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders...

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...