axios vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20211
3. 20253
4. 202648

Newest CVEs

• CVE-2026-101899

  Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

  axios · axios

  Medium6.9
• CVE-2026-101909

  Axios: Prototype Pollution Gadget in axios toFormData Options

  axios · axios

  High8.3
• CVE-2026-101908

  Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

  axios · axios

  Medium6.9
• CVE-2026-101907

  Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

  axios · axios

  High7.0
• CVE-2026-101906

  Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

  axios · axios

  High8.2
• CVE-2026-101905

  Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

  axios · axios

  High7.6
• CVE-2026-101904

  Axios: Header Injection via Inherited headers After Minimal Interceptor

  axios · axios

  Medium6.9
• CVE-2026-101903

  Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

  axios · axios

  High8.2
• CVE-2026-101902

  Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

  axios · axios

  Medium6.9
• CVE-2026-101901

  Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

  axios · axios

  High8.2