axios

Security advisories33

• axios: axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`fixed in 1.16.0
• axios: axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergefixed in 1.15.2, 0.31.1
• axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFfixed in 1.15.0, 0.31.0
• axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`fixed in 1.15.2
• axios: Axios: Excessive recursion in formDataToJSON can cause denial of servicefixed in 0.33.0, 1.18.0
• axios: Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfigfixed in 1.13.5, 0.30.3
• axios: Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamfixed in 1.15.1
• axios: Axios is vulnerable to DoS attack through lack of data size checkfixed in 1.12.0, 0.30.2
• axios: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0fixed in 1.15.1, 0.31.1
• axios: Axios: unbounded recursion in toFormData causes DoS via deeply nested request datafixed in 1.15.1, 0.31.1
• axios: Axios: Header Injection via Prototype Pollutionfixed in 1.15.1, 0.31.1
• axios: Axios: Nested axios option objects can consume polluted prototype valuesfixed in 0.33.0, 1.18.0
• axios: axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsfixed in 1.16.0, 0.32.0
• axios: Server-Side Request Forgery in axiosfixed in 1.7.4
• axios: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Methodfixed in 0.34.0, 1.20.0
• axios: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chainfixed in 1.15.0, 0.31.0
• axios: Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionfixed in 1.16.0, 0.32.0
• axios: Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionfixed in 1.16.0, 0.32.0
• axios: Axios: Header Injection via Inherited headers After Minimal Interceptorfixed in 1.20.0
• axios: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLfixed in 1.8.2, 0.30.0
• axios: Axios: no_proxy bypass via IP alias allows SSRFfixed in 1.15.1, 0.31.1
• axios: Axios: Prototype pollution gadgets can alter axios request constructionfixed in 1.18.0, 0.33.0
• axios: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapterfixed in 1.16.0, 0.32.0
• axios: Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackingfixed in 1.15.1, 0.31.1
• axios: axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)fixed in 1.16.0, 0.32.0
• axios: Axios: Deep formToJSON Key Recursion Can Cause Denial of Servicefixed in 0.33.0, 1.18.0
• axios: Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0fixed in 1.15.1, 0.31.1
• axios: Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijackingfixed in 1.15.2
• axios: Axios: HTTP adapter streamed responses bypass maxContentLengthfixed in 1.15.1, 0.31.1
• axios: Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategyfixed in 1.15.1, 0.31.1
• axios: Axios Cross-Site Request Forgery Vulnerabilityfixed in 1.6.0, 0.28.0
• axios: Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsfixed in 1.15.1, 0.31.1
• axios: Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercionfixed in 1.15.1, 0.31.1

Versions that change something