Skip to content
Noroxi

axios records

44 published records for vendor axios.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

44 records
  • CVE-2026-42043
    40Plan

    Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

    CriticalCVSS 10.0No exploitEPSS 0%

    axios · axiosApr 24, 2026

  • CVE-2024-57965
    39Monitor

    In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted s

    CriticalCVSS 9.8No exploitEPSS 0%

    axios · axiosJan 29, 2025

  • CVE-2026-42264
    36Monitor

    Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

    CriticalCVSS 9.1No exploitEPSS 0%

    axios · axiosMay 8, 2026

  • CVE-2026-42044
    36Monitor

    Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

    CriticalCVSS 9.1No exploitEPSS 0%

    axios · axiosApr 24, 2026

  • CVE-2026-44494
    34Monitor

    Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

    HighCVSS 8.7No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2026-44492
    34Monitor

    Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

    HighCVSS 8.6No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2021-3749
    33Monitor

    Inefficient Regular Expression Complexity in axios/axios

    HighCVSS 7.5Proof of conceptEPSS 8%

    axios · axiosAug 31, 2021

  • CVE-2026-67320
    33Monitor

    axios before 0.33.0 Prototype Pollution via Node HTTP adapter

    HighCVSS 8.3No exploitEPSS 0%

    axios · axiosAug 1, 2026

  • CVE-2019-10742
    32Monitor

    Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after

    HighCVSS 7.5Proof of conceptEPSS 6%

    axios · axiosMay 7, 2019

  • CVE-2026-44487
    32Monitor

    Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

    HighCVSS 8.2No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2026-44490
    32Monitor

    Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

    HighCVSS 8.2No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2026-25639
    31Monitor

    Axios affected by Denial of Service via __proto__ Key in mergeConfig

    HighCVSS 7.5No exploitEPSS 1%

    axios · axiosFeb 9, 2026

  • CVE-2024-39338
    30Monitor

    axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

    HighCVSS 7.5No exploitEPSS 1%

    axios · axiosAug 12, 2024

  • CVE-2025-58754
    30Monitor

    Axios is vulnerable to DoS attack through lack of data size check

    HighCVSS 7.5No exploitEPSS 1%

    axios · axiosSep 11, 2025

  • CVE-2026-44495
    30Monitor

    Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

    HighCVSS 7.7No exploitEPSS 1%

    axios · axiosJun 11, 2026

  • CVE-2026-44496
    30Monitor

    Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

    HighCVSS 7.5No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2026-44488
    30Monitor

    Axios: Allocation of Resources Without Limits or Throttling in axios

    HighCVSS 7.5No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2025-27152
    30Monitor

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    HighCVSS 7.7Proof of conceptEPSS 0%

    axios · axiosMar 7, 2025

  • CVE-2026-44486
    30Monitor

    Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

    HighCVSS 7.5No exploitEPSS 0%

    axios · axiosJun 11, 2026

  • CVE-2026-42038
    30Monitor

    Axios: no_proxy bypass via IP alias allows SSRF

    HighCVSS 7.5No exploitEPSS 0%

    axios · axiosApr 24, 2026

  • CVE-2026-42033
    29Monitor

    Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

    HighCVSS 7.4No exploitEPSS 0%

    axios · axiosApr 24, 2026

  • CVE-2026-42035
    29Monitor

    Axios: Header Injection via Prototype Pollution

    HighCVSS 7.4No exploitEPSS 0%

    axios · axiosApr 24, 2026

  • CVE-2026-42039
    27Monitor

    Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

    MediumCVSS 6.9No exploitEPSS 0%

    axios · axiosApr 24, 2026

  • CVE-2026-67321
    27Monitor

    axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

    MediumCVSS 6.9No exploitEPSS 0%

    axios · axiosAug 1, 2026

  • CVE-2026-67315
    27Monitor

    axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

    MediumCVSS 6.9No exploitEPSS 0%

    axios · axiosAug 1, 2026