368 matches found
CVE-2026-67317
A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...
CVE-2026-67314
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in it...
Linux Distros Unpatched Vulnerability : CVE-2026-67316
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate...
Linux Distros Unpatched Vulnerability : CVE-2026-67319
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has...
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...
CVE-2026-67319
axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...
CVE-2026-67319
axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...
CVE-2026-67312
Axios versions 0.28.0–0.32.x and 1.0.0–1.17.x are vulnerable to DoS due to uncontrolled recursion in formDataToJSON when serializing FormData with Content-Type: application/json. A field name with thousands of nested bracket-delimited segments can cause unbounded recursion in buildPath(), trigger...
EUVD-2026-51812
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denia...
EUVD-2026-51829
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can...
EUVD-2026-51827
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...
CVE-2026-67321
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...
CVE-2026-67321
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...
CVE-2026-67319 axios before 0.33.0 Prototype Pollution via nested option objects
axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
EUVD-2026-51847
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields
axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...
CVE-2026-67317
CVE-2026-67317 affects Axios versions 1.7.0 before 1.18.0. The fetch adapter fails to enforce maxBodyLength for WHATWG ReadableStream request bodies when Content-Length cannot be determined, allowing unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or ...