npm

axios

46 Total advisories

45 Vulnerabilities

1 Malware

Dependency scanning

Check whether axios is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

axios

Malware Advisories

Malicious code in axios (npm)

Vulnerabilities

Axios: Prototype pollution auth subfields can inject Basic auth

Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth

Axios form serializer maxDepth bypass via {} metatoken

Axios: Nested axios option objects can consume polluted prototype values

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Axios: Excessive recursion in formDataToJSON can cause denial of service

Axios: Prototype pollution gadgets can alter axios request construction

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Allocation of Resources Without Limits or Throttling in Axios

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Axios: no_proxy bypass via IP alias allows SSRF

Axios: HTTP adapter streamed responses bypass maxContentLength

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

Axios: Header Injection via Prototype Pollution

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios HTTP/2 Session Cleanup State Corruption Vulnerability

Withdrawn Advisory: Axios has Transitive Critical Vulnerability via form-data

Server-Side Request Forgery in axios

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

Axios is vulnerable to DoS attack through lack of data size check

Axios Cross-Site Request Forgery Vulnerability

axios Inefficient Regular Expression Complexity vulnerability

Axios vulnerable to Server-Side Request Forgery

Denial of Service in axios

Browse more npm advisories

Start Securing

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig