axios vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-101904Mediumaxios: Axios: Header Injection via Inherited headers After Minimal InterceptorCVE-2026-101900Mediumaxios: Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersCVE-2026-101905Highaxios: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionCVE-2026-101899Mediumaxios: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesCVE-2026-101907Highaxios: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFCVE-2026-101908Mediumaxios: Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsCVE-2026-101902Mediumaxios: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP MethodCVE-2026-101903Highaxios: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)CVE-2026-101906Highaxios: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect LocationCVE-2026-101909Highaxios: Axios: Prototype Pollution Gadget in axios toFormData OptionsCVE-2026-101898Highaxios: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsCVE-2026-101901Highaxios: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session InitializationCVE-2026-67320Highaxios: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningCVE-2026-67321Mediumaxios: Axios form serializer maxDepth bypass via {} metatokenCVE-2026-67319Mediumaxios: Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67318Mediumaxios: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`CVE-2026-67317Mediumaxios: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`CVE-2026-67316Mediumaxios: Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67315Mediumaxios: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosCVE-2026-67313Mediumaxios: Axios: Excessive recursion in formDataToJSON can cause denial of serviceCVE-2026-67314Mediumaxios: Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-67312Mediumaxios: Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceCVE-2026-44496Highaxios: Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44488Highaxios: Allocation of Resources Without Limits or Throttling in AxiosCVE-2026-44487Highaxios: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo