axios kayıtları
axios üreticisine ait 44 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')6
- CWE-400 Uncontrolled Resource Consumption5
- CWE-770 Allocation of Resources Without Limits or Throttling5
- CWE-918 Server-Side Request Forgery (SSRF)5
- CWE-183 Permissive List of Allowed Inputs3
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')3
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
44 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2026-42043İstismar yok | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0axios · axios · CWE-183 | Kritik10,0 | — | %0,6 | 24 Nis 2026 |
39İzleyin | CVE-2024-57965İstismar yok | In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted saxios · axios · CWE-346 | Kritik9,8 | — | %0,4 | 29 Oca 2025 |
36İzleyin | CVE-2026-42264İstismar yok | Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingaxios · axios · CWE-1321 | Kritik9,1 | — | %1,0 | 8 May 2026 |
36İzleyin | CVE-2026-42044İstismar yok | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`axios · axios · CWE-915 | Kritik9,1 | — | %0,9 | 24 Nis 2026 |
34İzleyin | CVE-2026-44494İstismar yok | Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`axios · axios · CWE-441 | Yüksek8,7 | — | %0,9 | 11 Haz 2026 |
34İzleyin | CVE-2026-44492İstismar yok | Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)axios · axios · CWE-918 | Yüksek8,6 | — | %0,8 | 11 Haz 2026 |
33İzleyin | CVE-2021-3749Kavram kanıtı | Inefficient Regular Expression Complexity in axios/axiosaxios · axios · CWE-1333 | Yüksek7,5 | — | %8,5 | 31 Ağu 2021 |
33İzleyin | CVE-2026-67320İstismar yok | axios before 0.33.0 Prototype Pollution via Node HTTP adapteraxios · axios · CWE-200 | Yüksek8,3 | — | %0,5 | 1 Ağu 2026 |
32İzleyin | CVE-2019-10742Kavram kanıtı | Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after axios · axios · CWE-755 | Yüksek7,5 | — | %6,1 | 7 May 2019 |
32İzleyin | CVE-2026-44487İstismar yok | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapteraxios · axios · CWE-201 | Yüksek8,2 | — | %0,8 | 11 Haz 2026 |
32İzleyin | CVE-2026-44490İstismar yok | Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsaxios · axios · CWE-1321 | Yüksek8,2 | — | %0,4 | 11 Haz 2026 |
31İzleyin | CVE-2026-25639İstismar yok | Axios affected by Denial of Service via __proto__ Key in mergeConfigaxios · axios · CWE-754 | Yüksek7,5 | — | %1,8 | 9 Şub 2026 |
30İzleyin | CVE-2024-39338İstismar yok | axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.axios · axios · CWE-918 | Yüksek7,5 | — | %1,2 | 12 Ağu 2024 |
30İzleyin | CVE-2025-58754İstismar yok | Axios is vulnerable to DoS attack through lack of data size checkaxios · axios · CWE-770 | Yüksek7,5 | — | %1,1 | 11 Eyl 2025 |
30İzleyin | CVE-2026-44495İstismar yok | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergeaxios · axios · CWE-94 | Yüksek7,7 | — | %1,0 | 11 Haz 2026 |
30İzleyin | CVE-2026-44496İstismar yok | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionaxios · axios · CWE-400 | Yüksek7,5 | — | %1,0 | 11 Haz 2026 |
30İzleyin | CVE-2026-44488İstismar yok | Axios: Allocation of Resources Without Limits or Throttling in axiosaxios · axios · CWE-770 | Yüksek7,5 | — | %0,9 | 11 Haz 2026 |
30İzleyin | CVE-2025-27152Kavram kanıtı | Possible SSRF and Credential Leakage via Absolute URL in axios Requestsaxios · axios · CWE-918 | Yüksek7,7 | — | %0,8 | 7 Mar 2025 |
30İzleyin | CVE-2026-44486İstismar yok | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionaxios · axios · CWE-200 | Yüksek7,5 | — | %0,8 | 11 Haz 2026 |
30İzleyin | CVE-2026-42038İstismar yok | Axios: no_proxy bypass via IP alias allows SSRFaxios · axios · CWE-918 | Yüksek7,5 | — | %0,4 | 24 Nis 2026 |
29İzleyin | CVE-2026-42033İstismar yok | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackingaxios · axios · CWE-1321 | Yüksek7,4 | — | %0,9 | 24 Nis 2026 |
29İzleyin | CVE-2026-42035İstismar yok | Axios: Header Injection via Prototype Pollutionaxios · axios · CWE-113 | Yüksek7,4 | — | %0,4 | 24 Nis 2026 |
27İzleyin | CVE-2026-42039İstismar yok | Axios: unbounded recursion in toFormData causes DoS via deeply nested request dataaxios · axios · CWE-674 | Orta6,9 | — | %1,0 | 24 Nis 2026 |
27İzleyin | CVE-2026-67321İstismar yok | axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassaxios · axios · CWE-674 | Orta6,9 | — | %0,5 | 1 Ağu 2026 |
27İzleyin | CVE-2026-67315İstismar yok | axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0axios · axios · CWE-183 | Orta6,9 | — | %0,5 | 1 Ağu 2026 |
- CVE-2026-4204340Planlayın
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
KritikCVSS 10,0İstismar yokEPSS %1axios · axios24 Nis 2026
- CVE-2024-5796539İzleyin
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted s
KritikCVSS 9,8İstismar yokEPSS %0axios · axios29 Oca 2025
- CVE-2026-4226436İzleyin
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
KritikCVSS 9,1İstismar yokEPSS %1axios · axios8 May 2026
- CVE-2026-4204436İzleyin
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
KritikCVSS 9,1İstismar yokEPSS %1axios · axios24 Nis 2026
- CVE-2026-4449434İzleyin
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
YüksekCVSS 8,7İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2026-4449234İzleyin
Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
YüksekCVSS 8,6İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2021-374933İzleyin
Inefficient Regular Expression Complexity in axios/axios
YüksekCVSS 7,5Kavram kanıtıEPSS %9axios · axios31 Ağu 2021
- CVE-2026-6732033İzleyin
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
YüksekCVSS 8,3İstismar yokEPSS %1axios · axios1 Ağu 2026
- CVE-2019-1074232İzleyin
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after
YüksekCVSS 7,5Kavram kanıtıEPSS %6axios · axios7 May 2019
- CVE-2026-4448732İzleyin
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
YüksekCVSS 8,2İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2026-4449032İzleyin
Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
YüksekCVSS 8,2İstismar yokEPSS %0axios · axios11 Haz 2026
- CVE-2026-2563931İzleyin
Axios affected by Denial of Service via __proto__ Key in mergeConfig
YüksekCVSS 7,5İstismar yokEPSS %2axios · axios9 Şub 2026
- CVE-2024-3933830İzleyin
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
YüksekCVSS 7,5İstismar yokEPSS %1axios · axios12 Ağu 2024
- CVE-2025-5875430İzleyin
Axios is vulnerable to DoS attack through lack of data size check
YüksekCVSS 7,5İstismar yokEPSS %1axios · axios11 Eyl 2025
- CVE-2026-4449530İzleyin
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
YüksekCVSS 7,7İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2026-4449630İzleyin
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
YüksekCVSS 7,5İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2026-4448830İzleyin
Axios: Allocation of Resources Without Limits or Throttling in axios
YüksekCVSS 7,5İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2025-2715230İzleyin
Possible SSRF and Credential Leakage via Absolute URL in axios Requests
YüksekCVSS 7,7Kavram kanıtıEPSS %1axios · axios7 Mar 2025
- CVE-2026-4448630İzleyin
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
YüksekCVSS 7,5İstismar yokEPSS %1axios · axios11 Haz 2026
- CVE-2026-4203830İzleyin
Axios: no_proxy bypass via IP alias allows SSRF
YüksekCVSS 7,5İstismar yokEPSS %0axios · axios24 Nis 2026
- CVE-2026-4203329İzleyin
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
YüksekCVSS 7,4İstismar yokEPSS %1axios · axios24 Nis 2026
- CVE-2026-4203529İzleyin
Axios: Header Injection via Prototype Pollution
YüksekCVSS 7,4İstismar yokEPSS %0axios · axios24 Nis 2026
- CVE-2026-4203927İzleyin
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
OrtaCVSS 6,9İstismar yokEPSS %1axios · axios24 Nis 2026
- CVE-2026-6732127İzleyin
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
OrtaCVSS 6,9İstismar yokEPSS %1axios · axios1 Ağu 2026
- CVE-2026-6731527İzleyin
axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
OrtaCVSS 6,9İstismar yokEPSS %0axios · axios1 Ağu 2026