Axios vulnerabilitiesAxios: known vulnerabilities and safe versions
npm: axios
Axios has 56 known vulnerability records: 55 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 1 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 1.x is safe from 1.20.0; 0.34.x has no fixed release in the records; 0.33.x has no fixed release in the records; 0.32.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 1.x | — | — | 53critical | 1.20.0 |
| 0.34.x | — | — | 1medium | No fix |
| 0.33.x | — | — | 3high | No fix |
| 0.32.x | — | — | 10high | No fix |
| 0.31.x | — | — | 26critical | No fix |
| 0.30.x | — | — | 27critical | No fix |
| 0.28.x | — | — | 28critical | No fix |
| 0.27.x | — | — | 25critical | No fix |
| 0.21.x | — | — | 26critical | No fix |
| 0.19.x | — | — | 26critical | No fix |
| 0.18.x | — | — | 26critical | No fix |
| 0.8.x | — | — | 26critical | No fix |
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2026-1018992026-10-13
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Affected versions: >= 1.15.0, < 1.20.0
medium 6.9
Fixed in: 1.20.0
CVE-2026-1019092026-09-28
Axios: Prototype Pollution Gadget in axios toFormData Options
Affected versions: >= 0.28.0, < 0.34.0 · >= 1.15.1, < 1.20.0
high 8.3
Fixed in: 0.34.0, 1.20.0
CVE-2026-1019082026-09-28
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Affected versions: >= 1.7.0, < 1.20.0
medium 6.9
Fixed in: 1.20.0
CVE-2026-1019072026-09-28
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Affected versions: >= 1.17.0, < 1.20.0
high 7.0
Fixed in: 1.20.0
CVE-2026-1019062026-09-28
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Affected versions: >= 1.15.0, < 1.20.0
high 8.2
Fixed in: 1.20.0
CVE-2026-1019052026-09-28
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Affected versions: >= 1.15.2, < 1.20.0
high 7.6
Fixed in: 1.20.0
CVE-2026-1019042026-09-28
Axios: Header Injection via Inherited headers After Minimal Interceptor
Affected versions: >= 1.0.0, < 1.20.0
medium 6.9
Fixed in: 1.20.0
CVE-2026-1019032026-09-28
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Affected versions: >= 1.16.1, < 1.20.0
high 8.2
Fixed in: 1.20.0
CVE-2026-1019022026-09-28
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Affected versions: >= 0.27.2, < 0.34.0 · >= 1.0.0, < 1.20.0
medium 6.9
Fixed in: 0.34.0, 1.20.0
CVE-2026-1019012026-09-28
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Affected versions: >= 1.13.0, < 1.20.0
high 8.2
Fixed in: 1.20.0
CVE-2026-1019002026-09-28
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Affected versions: >= 1.12.0, < 1.20.0
medium 6.9
Fixed in: 1.20.0
CVE-2026-1018982026-09-28
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Affected versions: >= 1.13.0, < 1.20.0
high 7.0
Fixed in: 1.20.0
CVE-2026-673212026-08-01
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Affected versions: >= 0.31.1, < 0.33.0 · >= 1.15.1, < 1.18.0
medium 6.9
Fixed in: 0.33.0, 1.18.0
CVE-2026-673202026-08-01
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
Affected versions: >= 0.31.1, < 0.33.0 · >= 1.15.2, < 1.18.0
high 8.3
Fixed in: 0.33.0, 1.18.0
CVE-2026-673192026-08-01
axios before 0.33.0 Prototype Pollution via nested option objects
Affected versions: >= 0.8.0, < 0.33.0 · >= 1.0.0, < 1.18.0
medium 6.3
Fixed in: 0.33.0, 1.18.0
CVE-2026-673182026-08-01
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
Affected versions: >= 1.13.0, < 1.18.0
medium 6.3
Fixed in: 1.18.0
CVE-2026-673172026-08-01
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
Affected versions: >= 1.7.0, < 1.18.0
medium 6.3
Fixed in: 1.18.0
CVE-2026-673162026-08-01
axios before 1.18.0 Prototype Pollution via bodyless methods
Affected versions: >= 1.0.0, < 1.18.0 · < 0.33.0
medium 6.3
Fixed in: 0.33.0, 1.18.0
CVE-2026-673152026-08-01
axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
Affected versions: >= 1.15.0, < 1.18.0 · >= 0.31.0, < 0.33.0
medium 6.9
Fixed in: 0.33.0, 1.18.0
CVE-2026-673142026-08-01
axios before 1.18.0 Prototype Pollution via auth subfields
Affected versions: >= 1.15.2, < 1.18.0
medium 6.3
Fixed in: 1.18.0
CVE-2026-673132026-08-01
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
Affected versions: >= 0.28.0, < 0.33.0 · >= 1.0.0, < 1.18.0
medium 6.3
Fixed in: 0.33.0, 1.18.0
CVE-2026-673122026-08-01
axios 0.28.0 before 0.33.0 Denial of Service via formToJSON
Affected versions: >= 0.28.0, < 0.33.0 · >= 1.0.0, < 1.18.0
medium 6.3
Fixed in: 0.33.0, 1.18.0
CVE-2026-444962026-06-11
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Affected versions: >= 1.0.0, < 1.16.0 · < 0.32.0
high 7.5
Fixed in: 0.32.0, 1.16.0
CVE-2026-444952026-06-11
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Affected versions: >= 1.0.0, < 1.15.2 · >= 0.19.0, < 0.31.1
high 7.7
Fixed in: 0.31.1, 1.15.2
EPSS 1%
CVE-2026-444942026-06-11
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Affected versions: >= 1.0.0, < 1.16.0
high 8.7
Fixed in: 1.16.0
CVE-2026-444922026-06-11
Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Affected versions: >= 1.15.0, < 1.16.0 · < 0.32.0
high 8.6
Fixed in: 0.32.0, 1.16.0
CVE-2026-444902026-06-11
Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Affected versions: >= 1.0.0, < 1.16.0 · < 0.32.0
high 8.2
Fixed in: 0.32.0, 1.16.0
CVE-2026-444892026-06-11
Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Affected versions: >= 1.15.2, < 1.16.0
medium 5.3
Fixed in: 1.16.0
CVE-2026-444882026-06-11
Axios: Allocation of Resources Without Limits or Throttling in axios
Affected versions: >= 1.7.0, < 1.16.0
high 7.5
Fixed in: 1.16.0
CVE-2026-444872026-06-11
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Affected versions: >= 1.0.0, < 1.16.0 · < 0.32.0
high 8.2
Fixed in: 0.32.0, 1.16.0
CVE-2026-444862026-06-11
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Affected versions: >= 1.0.0, < 1.16.0 · < 0.32.0
high 7.5
Fixed in: 0.32.0, 1.16.0
CVE-2026-422642026-05-08
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Affected versions: >= 1.0.0, < 1.15.2
critical 9.1
Fixed in: 1.15.2
CVE-2026-420442026-04-24
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Affected versions: >= 1.0.0, < 1.15.2
critical 9.1
Fixed in: 1.15.2
CVE-2026-420432026-04-24
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
critical 10.0
Fixed in: 0.31.1, 1.15.1
CVE-2026-420422026-04-24
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
medium 5.4
Fixed in: 0.31.1, 1.15.1
CVE-2026-420412026-04-24
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
medium 6.5
Fixed in: 0.31.1, 1.15.1
CVE-2026-420402026-04-24
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
low 3.7
Fixed in: 0.31.1, 1.15.1
CVE-2026-420392026-04-24
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
medium 6.9
Fixed in: 0.31.1, 1.15.1
CVE-2026-420382026-04-24
Axios: no_proxy bypass via IP alias allows SSRF
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
high 7.5
Fixed in: 0.31.1, 1.15.1
CVE-2026-420372026-04-24
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Affected versions: >= 1.0.0, < 1.15.1
medium 5.3
Fixed in: 1.15.1
CVE-2026-420362026-04-24
Axios: HTTP adapter streamed responses bypass maxContentLength
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
medium 5.3
Fixed in: 0.31.1, 1.15.1
CVE-2026-420352026-04-24
Axios: Header Injection via Prototype Pollution
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
high 7.4
Fixed in: 0.31.1, 1.15.1
CVE-2026-420342026-04-24
Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
medium 5.3
Fixed in: 0.31.1, 1.15.1
CVE-2026-420332026-04-24
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Affected versions: >= 1.0.0, < 1.15.1 · < 0.31.1
high 7.4
Fixed in: 0.31.1, 1.15.1
CVE-2026-40175exploit code exists2026-04-10
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Affected versions: >= 1.0.0, < 1.15.0 · < 0.31.0
medium 4.8
Fixed in: 0.31.0, 1.15.0
EPSS 2%
CVE-2025-627182026-04-09
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Affected versions: >= 1.0.0, < 1.15.0 · < 0.31.0
medium 6.3
Fixed in: 0.31.0, 1.15.0
EPSS 1.1%
CVE-2026-398652026-04-08
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Affected versions: >= 1.13.0, < 1.13.2
medium 5.9
Fixed in: 1.13.2
CVE-2026-256392026-02-09
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Affected versions: >= 1.0.0, < 1.13.5 · < 0.30.3
high 7.5
Fixed in: 0.30.3, 1.13.5
EPSS 1.9%
CVE-2025-587542025-09-12
Axios is vulnerable to DoS attack through lack of data size check
Affected versions: >= 1.0.0, < 1.12.0 · >= 0.28.0, < 0.30.2
high 7.5
Fixed in: 0.30.2, 1.12.0
EPSS 1.1%
CVE-2025-27152exploit code exists2025-03-07
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Affected versions: >= 1.0.0, < 1.8.2 · < 0.30.0
high 7.7
Fixed in: 0.30.0, 1.8.2
CVE-2024-393382024-08-12
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Affected versions: >= 1.3.2, < 1.7.4
high 7.5
Fixed in: 1.7.4
EPSS 1.2%
CVE-2023-45857exploit code exists2023-11-08
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-
Affected versions: >= 1.0.0, < 1.6.0 · >= 0.8.1, < 0.28.0
medium 6.5
Fixed in: 0.28.0, 1.6.0
CVE-2021-3749exploit code exists2021-08-31
Inefficient Regular Expression Complexity in axios/axios
Affected versions: < 0.21.2
high 7.5
Fixed in: 0.21.2
EPSS 8.5%
CVE-2020-281682020-11-06
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providin
Affected versions: < 0.21.1
medium 5.9
Fixed in: 0.21.1
EPSS 2.3%
CVE-2019-10742exploit code exists2019-05-07
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after
Affected versions: < 0.18.1
high 7.5
Fixed in: 0.18.1
EPSS 6.1%
no CVE
Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials
Affected versions: < 1.6.8
medium
Fixed in: 1.6.8
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 19, 2026.