Security vulnerabilities and automated fixes for axios issues
22 posts found
Axios versions prior to 1.15.1 merged untrusted configuration objects without guarding against the `__proto__` key, letting attacker-controlled input pollute `Object.prototype` and crash or destabilize applications. Upgrading axios (and its transitive dependencies `form-data`, `follow-redirects`, `proxy-from-env`) closes this Denial of Service and prototype-pollution attack surface without changing any application code.
A permissive semver range in `package.json` allowed npm to install axios versions vulnerable to SSRF (CVE-2024-39338). By bumping the minimum version from `^1.6.0` to `^1.7.4`, all downstream consumers of this SDK are now protected from server-side request forgery attacks. This critical fix required changing just one line in the dependency manifest.
A critical Server-Side Request Forgery (SSRF) vulnerability was discovered in `maintenance/getImages.js`, where the `getImage()` function passed database-sourced URLs directly to `axios.get()` without any validation. An attacker who could modify the elements database could redirect these requests to internal network resources — including AWS cloud metadata endpoints — potentially exposing IAM credentials and other sensitive infrastructure data. The fix introduces a strict URL allowlist that limi
CVE-2026-25639 is a high-severity prototype pollution vulnerability in axios versions ≤1.13.2 that allowed attackers to cause denial of service by injecting a `__proto__` key into configuration objects. The fix upgrades axios to 1.18.0 in `client/package.json`, eliminating the unsafe object merge behavior that made the application vulnerable.
CVE-2025-27152 is a high-severity vulnerability in axios versions prior to 1.8.2 that allows Server-Side Request Forgery (SSRF) and credential leakage when absolute URLs are passed in requests. By upgrading from the vulnerable `^1.7.4` range (which resolved to `1.7.9`) to the pinned `1.8.2`, the attack surface for intercepting or redirecting authenticated HTTP requests is eliminated. Any Node.js application that passes user-influenced URLs to axios is potentially affected.
CVE-2026-42033 is a high-severity prototype pollution vulnerability in axios that allows attackers to hijack the HTTP transport layer used by the library. The deltamod project was running axios 1.14.0, which lacked the hardened transport configuration introduced in 1.18.0 — including an explicit `https-proxy-agent` dependency and an upgraded `follow-redirects` floor. Upgrading to axios 1.18.0 closes the attack surface by ensuring that object prototype manipulation cannot silently redirect or int
CVE-2025-58754 is a high-severity Denial of Service vulnerability in the popular axios HTTP client library, caused by the absence of a data size check on incoming response or request payloads. An attacker who can influence the size of data processed by axios could exhaust server memory or CPU, bringing down dependent Node.js applications. The fix upgrades axios from version 1.8.4 to 1.18.0, closing the unbounded data processing path.
A high-severity vulnerability (CVE-2026-44486) in Axios versions prior to 1.16.0 caused Proxy-Authorization headers to leak to redirect targets when the HTTP client re-evaluated proxy settings and switched to a direct connection. This information disclosure bug exposed sensitive proxy credentials to unintended destinations, and was fixed by upgrading from Axios 1.15.2 to 1.18.0 in the client application.
Axios versions prior to 1.18.0 contained a prototype pollution vulnerability that could allow attackers to inject arbitrary HTTP headers into requests. This vulnerability was fixed by upgrading to version 1.18.0, which includes enhanced input validation and updated proxy handling dependencies. Organizations using the affected versions should update immediately to prevent potential man-in-the-middle attacks and header injection exploits.
A high-severity denial of service vulnerability (CVE-2026-25639) was discovered in Axios versions prior to 1.13.5, where the `mergeConfig` function failed to properly sanitize the `__proto__` key in configuration objects. This prototype pollution vulnerability could allow attackers to crash Node.js applications or cause unexpected behavior by manipulating JavaScript's prototype chain. The fix involved upgrading from Axios 1.13.2 to 1.18.0, which includes enhanced input validation in the configur
A high-severity vulnerability (CVE-2026-42035) in axios version 1.13.5 allowed attackers to inject arbitrary HTTP headers through prototype pollution. The fix upgrades axios to version 1.18.0 in the frontend's dependency tree, which includes proper prototype chain validation when constructing HTTP request headers. This prevents attackers from manipulating outgoing requests to perform SSRF, session hijacking, or cache poisoning attacks.
A high-severity vulnerability (CVE-2026-42043) in the axios HTTP client library allowed attackers to bypass NO_PROXY environment variable restrictions using specially crafted URLs. This could route sensitive internal traffic through attacker-controlled proxy servers. The fix upgrades axios from 1.13.6 to 1.18.0, which includes a rewritten proxy resolution mechanism using `proxy-from-env` v2.1.0 and the `https-proxy-agent` package.