Axios

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 8.3HighAug 1, 2026axios Information disclosureCVE-2026-67320axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Ob
• 7.5HighJun 11, 2026axios Information disclosureCVE-2026-44486Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios
• 8.2HighJun 11, 2026axios Information disclosureCVE-2026-44487Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent
• 7.5HighJun 11, 2026axios Denial of serviceCVE-2026-44488Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved t
• 4.8MediumJun 11, 2026axiosCVE-2026-44490Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the p
• 7.5HighJun 11, 2026axios Denial of serviceCVE-2026-44496Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who ca
• 7.0HighJun 11, 2026axios Code / command injectionCVE-2026-44495Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affecte1% likely
• 8.7HighJun 11, 2026axiosCVE-2026-44494Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM)
• 8.6HighJun 11, 2026axios SSRFCVE-2026-44492Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe)
• 6.8MediumApr 24, 2026axios SSRFCVE-2026-42038Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy(
• 7.4HighApr 24, 2026axiosCVE-2026-42035Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type che
• 7.4HighApr 24, 2026axiosCVE-2026-42033Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the appli
• 7.5HighFeb 9, 2026axiosCVE-2026-25639Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious confi2% likely
• 7.7HighMar 7, 2025axios SSRFCVE-2025-27152axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
• 4.0MediumAug 9, 2024axios SSRFCVE-2024-39338axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.1.2% likely

See every Axios entry on the dashboard.

Top products

• axios13 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Aug 18, 2026Atlassian Security Bulletin August 18, 2026CVE-2026-67320
• Atlassian · Jul 21, 2026Atlassian Security Bulletin July 21, 2026CVE-2026-44490CVE-2026-44494CVE-2026-44495
• Atlassian · Jun 16, 2026Atlassian Security Bulletin June 16, 2026CVE-2026-42033CVE-2026-42035CVE-2026-42038CVE-2026-44486CVE-2026-44487CVE-2026-44488
• Atlassian · Apr 21, 2026Atlassian Security Bulletin April 21, 2026CVE-2026-25639
• Atlassian · Mar 17, 2026Atlassian Security Bulletin March 17, 2026CVE-2026-25639
• Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2025-27152
• Atlassian · Jan 21, 2025Atlassian Security Bulletin January 21, 2025CVE-2024-39338