Axios vulnerabilities

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.

An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names, it can lead to stack exhaustion.

Axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options().

A vulnerability in Axios prior to versions 1.15.0 and 0.31.0 incorrectly handles hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

In axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0, there is an incomplete depth-limit bypass in toFormData.js. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).

Axios before version 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

Axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default maxBodyLength: -1 and browser adapters are not affected.

Axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

Axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.

In axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0, 0.0.0.0 is not recognized as a loopback address in shouldBypassProxy.js. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

Axios versions 1.15.2 through 1.17.9 contain prototype-pollution read-side gadgets in Basic auth subfield handling. If an application is already affected by prototype pollution and makes an axios request with an auth object missing username/password, axios reads inherited Object.prototype values and uses them to construct an Authorization header. Axios itself does not pollute prototypes.

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. An attacker can supply FormData with thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination.

Axios versions 0.28.0 through 0.32.9 and 1.0.0 through 1.17.9 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). Passing attacker-controlled FormData field names with thousands of nested bracket segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack and causing a RangeError, leading to denial of service.

A vulnerability in Axios (versions before 0.32.0 on 0.x and before 1.16.0 on 1.x) fails to escape regex metacharacters in the XSRF cookie name. An attacker who can influence the cookie name passed to Axios can cause expensive regex backtracking while reading document.cookie, leading to client-side availability degradation (e.g., freezing the browser tab).

Vulnerability in Axios library (HTTP client for browser and Node.js). In versions from 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability has already polluted Object.prototype.transformResponse, Axios may treat that value as request configuration.

Axios versions 1.0.0 to before 1.16.0 are vulnerable to a Prototype Pollution Gadget attack. An attacker can escalate Object.prototype pollution into a full Man-in-the-Middle (MITM) attack, intercepting and modifying all HTTP traffic including credentials.

In Axios prior to versions 0.32.0 and 1.16.0, IPv4-mapped IPv6 addresses are not normalized. When NO_PROXY lists an IPv4 address, a request using the IPv4-mapped IPv6 form still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy.

Axios, a promise-based HTTP client, prior to versions 0.32.0 and 1.16.0, was vulnerable to prototype pollution attacks. As a result, polluted values could be silently captured and used in request headers.

A vulnerability in Axios, an HTTP client, allows for the injection of malicious data into the Proxy-Authorization header if the proxy object is polluted. The issue exists in versions from 1.15.2 to before 1.16.0, where the setProxy() function does not check object properties.

Axios versions 1.7.0 through 1.15.x do not enforce configured request and response size limits when using the fetch adapter. This can lead to server resource exhaustion.

In Axios, a promise-based HTTP client for browser and Node.js, prior to versions 0.32.0 and 1.16.0, the Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage where an initial request is sent through an authenticated HTTP proxy, followed by a redirect to a URL that is no longer proxied. The final origin may receive the proxy credential.

Axios, an HTTP client for Node.js, can leak proxy credentials to a redirect target. When a request is sent through an authenticated proxy, a Proxy-Authorization header is added and persists after a redirect, even if the new request no longer goes through that proxy.

In Axios versions 1.0.0 through 1.15.1, five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) in the HTTP adapter are read without hasOwnProperty checks, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency, Axios silently picks up these polluted values on every outbound HTTP request.

Axios versions 1.0.0 through 1.15.1 are vulnerable to a Prototype Pollution Gadget attack, allowing modification of JSON API responses, including privilege escalation and data manipulation.

A vulnerability in the Axios library allows an attacker who can influence the target URL of a request to completely bypass NO_PROXY protection using any address in the 127.0.0.0/8 range (other than 127.0.0.1). This is an incomplete fix for CVE-2025-62718.

A vulnerability in Axios before versions 1.15.1 and 0.31.1 allows a Prototype Pollution attack that causes all HTTP responses (including errors 401, 403, 500) to be treated as success. Authentication and error handling are bypassed.

A vulnerability in Axios versions prior to 1.15.1 and 0.31.1 crashes the Node.js process with a RangeError when processing deeply nested objects in the toFormData function. The lack of recursion depth limit allows an attacker to cause a denial of service (DoS) by sending specially crafted data.

A vulnerability in Axios (versions before 1.15.1 and 0.31.1) allows an attacker to intercept and modify JSON responses or fully hijack HTTP transport if Object.prototype has been polluted by another dependency. The precondition is a separate prototype pollution source in the same process.

A vulnerability in Axios versions prior to 1.15.0 and 0.3.1 allows a gadget-style attack chain where prototype pollution in a third-party dependency can be leveraged to inject unsanitized header values into outbound HTTP requests.

A vulnerability in Axios from version 1.13.0 to 1.13.1. The HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client through concurrent session closures.

The mergeConfig function in Axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger a complete denial of service by providing a malicious configuration object created via JSON.parse().