axios-ssrf

Get Started run pnpm install on the root, backend, and frontend directories run pnpm start:dev on the root directory Vulnerabilities This website is published on: https://axios-ssrf.onrender.com/ Server Side Request Forgery: I specifically used a version of axios that is vulnerable to SSRF attack...

axios-supply-chain-cve-2026-26555

🔍 Vulnerability Research A curated collection of in-depth vulnerability writeups covering real-world security incidents in the software ecosystem. Each entry includes a full technical analysis, proof-of-concept, IOC listing, and remediation guidance. Purpose: Educational reference and portfolio...

CVE-2026-40175

🚨 CVE-2026-40175 - Critical Vulnerability in Axios Prototype Pollution Gadget → Remote Code Execution & Cloud Compromise 📢 Overview Axios — one of the most popular HTTP clients for JavaScript browser & Node.js — contains a critical vulnerability prior to version 1.15.0. A specific "gadget" attack...

CVE-2026-40175-poc

CVE-2026-40175 — Axios CRLF Injection / HTTP Request Smuggling PoC Overview A CRLF injection vulnerability caused by AxiosHeaders.set in the Axios HTTP client =1.0.0 =1.0.0 1.15.0, axios 0.31.0 Patched Versions| 1.15.0, 0.31.0 CWE| CWE-93 Improper Neutralization of CRLF Sequences Root Cause...

axios-security-guide

This repository does not have a README...

audit-axios

audit-axios Scan local repos for vulnerable axios versions and patch interactively. Targets CVE-2026-40175 — CRLF Header Injection leading to Request Smuggling & SSRF. CVSS 9.9, affects all axios 1.15.0. Quick Start npx audit-axios /Workspace /Projects Usage Interactive — checkbox select + bulk...

CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

CVE-2023-45857-Demo

Demo to verify the behavior of axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev on the app container 3. Access http://app.localhost 4. Verify that XSRF-TOKEN is set in the Cookie using the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false...

axios-redos

Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...

axios-CVE-2025-27152-PoC

This repository does not have a README...

CLSA-2026-1792429317 TuxCare security update for axios (11 CVEs)

TuxCare rebuilt axios to address 11 CVEs. Fixed in 1.18.0-tuxcare.2...

CLSA-2026-1792429081 TuxCare security update for axios (12 CVEs)

TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.17.0-tuxcare.3...

CVE-2022-0155-PoC

CVE-2022-0155 Proof-of-Concept PoC This repository contains a demonstration of the CVE-2022-0155 vulnerability. The vulnerability was detected by ranjit-git and is described in detail here. The purpose of this PoC is to demonstrate that the vulnerability doesn't just apply to scenarios where...

CLSA-2026-1792193199 TuxCare security update for axios (4 CVEs)

TuxCare rebuilt axios to address 4 CVEs. Fixed in 1.16.0-tuxcare.3...

CLSA-2026-1792193115 TuxCare security update for axios (2 CVEs)

TuxCare rebuilt axios to address 2 CVEs. Fixed in 1.18.1-tuxcare.2...

CLSA-2026-1792190983 TuxCare security update for axios (6 CVEs)

TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.13.5-tuxcare.2...

CLEANSTART-2026-ZN41930 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-AQ06052 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-SE41878 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-XJ53800 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...