Log in Start free

axios

Products

ProductCVEsExploitedLatest
axios51–Oct 13, 2026
axios/axios1–Aug 31, 2021

Exploited and recent CVEs

  • CVE-2026-101899 Medium 6.9 Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 0.5%
  • CVE-2026-101909 High 8.3 Axios: Prototype Pollution Gadget in axios toFormData Options 0.5%
  • CVE-2026-101908 Medium 6.9 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests 0.5%
  • CVE-2026-101907 High 7.0 Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF 0.5%
  • CVE-2026-101906 High 8.2 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location 0.5%
  • CVE-2026-101905 High 7.6 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection 0.4%
  • CVE-2026-101904 Medium 6.9 Axios: Header Injection via Inherited headers After Minimal Interceptor 0.5%
  • CVE-2026-101903 High 8.2 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) 0.4%
  • CVE-2026-101902 Medium 6.9 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method 0.4%
  • CVE-2026-101901 High 8.2 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization 0.5%
  • CVE-2026-101900 Medium 6.9 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders 0.5%
  • CVE-2026-101898 High 7.0 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls 0.5%
  • CVE-2026-67321 Medium 6.9 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 0.5%
  • CVE-2026-67319 Medium 6.3 axios before 0.33.0 Prototype Pollution via nested option objects 0.3%
  • CVE-2026-67318 Medium 6.3 axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 0.6%
  • CVE-2026-67316 Medium 6.3 axios before 1.18.0 Prototype Pollution via bodyless methods 0.4%
  • CVE-2026-67315 Medium 6.9 axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 0.5%
  • CVE-2026-67312 Medium 6.3 axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON 0.5%
  • CVE-2026-67320 High 8.3 axios before 0.33.0 Prototype Pollution via Node HTTP adapter 0.5%
  • CVE-2026-67317 Medium 6.3 axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 0.6%
  • CVE-2026-67314 Medium 6.3 axios before 1.18.0 Prototype Pollution via auth subfields 0.4%
  • CVE-2026-67313 Medium 6.3 axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 0.5%
  • CVE-2026-44486 High 7.5 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 0.6%
  • CVE-2026-44487 High 7.5 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 0.7%
  • CVE-2026-44488 High 7.5 Axios: Allocation of Resources Without Limits or Throttling in axios 0.7%
  • CVE-2026-44490 Medium 4.8 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 0.3%
  • CVE-2026-44496 High 7.5 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 5.4%
  • CVE-2026-44495 High 7.0 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 0.9%
  • CVE-2026-44494 High 8.7 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` 1.1%
  • CVE-2026-44489 Low 3.7 Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix 0.2%