Axios vulnerabilities

Axios versions 1.15.0 through 1.20.0 incorrectly treat NO_PROXY CIDR entries as textual hostname suffixes instead of network ranges. A request to an address covered by a CIDR entry in NO_PROXY is not matched and is sent through the configured proxy. For plaintext HTTP the proxy can observe and modify URLs, headers, and bodies; for HTTPS it can observe connection metadata and CONNECT requests.

Axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options().

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.

An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names, it can lead to stack exhaustion.

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

A vulnerability in Axios prior to versions 1.15.0 and 0.31.0 incorrectly handles hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

Axios from 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0 processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function.

In Axios from version 1.7.0 to 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior.

Axios from 1.17.0 until 1.20.0 in the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response, but the underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled.

Axios from 1.15.0 until 1.20.0 in shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. When HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character, the regular expression can backtrack quadratically, blocking the Node.js event loop and causing denial of service.

Axios from 1.15.2 until 1.20.0 in the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate.

In Axios from version 1.0.0 to 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values.

Axios from 1.16.1 until 1.20.0 in the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. The JavaScript regular-expression engine explores many separator placements before rejecting the URL. Excessive backtracking can block the Node.js event loop and cause denial of service.

In Axios from version 0.27.2 to 0.34.0 and 1.20.0, default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch.

Axios from 1.13.0 until 1.20.0 in Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service.

In Axios from version 1.12.0 to 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior.

Axios from 1.13.0 until 1.20.0 in HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy.

In axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0, there is an incomplete depth-limit bypass in toFormData.js. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).

Axios before version 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

Axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on maxRedirects === 0, an attacker who controls a stream passed to axios can cause the application to transmit outbound data exceeding the configured finite maxBodyLength. Impact is limited to resource consumption and policy bypass (excess egress, upstream quota consumption, limited availability); it does not enable code execution, credential disclosure, or request-destination control. Calls using the default maxBodyLength: -1 and browser adapters are not affected.

Axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

Axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.

In axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0, 0.0.0.0 is not recognized as a loopback address in shouldBypassProxy.js. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

Axios versions 1.15.2 through 1.17.9 contain prototype-pollution read-side gadgets in Basic auth subfield handling. If an application is already affected by prototype pollution and makes an axios request with an auth object missing username/password, axios reads inherited Object.prototype values and uses them to construct an Authorization header. Axios itself does not pollute prototypes.

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. An attacker can supply FormData with thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination.

Axios versions 0.28.0 through 0.32.9 and 1.0.0 through 1.17.9 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). Passing attacker-controlled FormData field names with thousands of nested bracket segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack and causing a RangeError, leading to denial of service.

A vulnerability in Axios (versions before 0.32.0 on 0.x and before 1.16.0 on 1.x) fails to escape regex metacharacters in the XSRF cookie name. An attacker who can influence the cookie name passed to Axios can cause expensive regex backtracking while reading document.cookie, leading to client-side availability degradation (e.g., freezing the browser tab).

Vulnerability in Axios library (HTTP client for browser and Node.js). In versions from 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability has already polluted Object.prototype.transformResponse, Axios may treat that value as request configuration.

Axios versions 1.0.0 to before 1.16.0 are vulnerable to a Prototype Pollution Gadget attack. An attacker can escalate Object.prototype pollution into a full Man-in-the-Middle (MITM) attack, intercepting and modifying all HTTP traffic including credentials.

In Axios prior to versions 0.32.0 and 1.16.0, IPv4-mapped IPv6 addresses are not normalized. When NO_PROXY lists an IPv4 address, a request using the IPv4-mapped IPv6 form still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy.

Axios, a promise-based HTTP client, prior to versions 0.32.0 and 1.16.0, was vulnerable to prototype pollution attacks. As a result, polluted values could be silently captured and used in request headers.

A vulnerability in Axios, an HTTP client, allows for the injection of malicious data into the Proxy-Authorization header if the proxy object is polluted. The issue exists in versions from 1.15.2 to before 1.16.0, where the setProxy() function does not check object properties.

Axios versions 1.7.0 through 1.15.x do not enforce configured request and response size limits when using the fetch adapter. This can lead to server resource exhaustion.

In Axios, a promise-based HTTP client for browser and Node.js, prior to versions 0.32.0 and 1.16.0, the Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage where an initial request is sent through an authenticated HTTP proxy, followed by a redirect to a URL that is no longer proxied. The final origin may receive the proxy credential.

Axios, an HTTP client for Node.js, can leak proxy credentials to a redirect target. When a request is sent through an authenticated proxy, a Proxy-Authorization header is added and persists after a redirect, even if the new request no longer goes through that proxy.

In Axios versions 1.0.0 through 1.15.1, five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) in the HTTP adapter are read without hasOwnProperty checks, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency, Axios silently picks up these polluted values on every outbound HTTP request.

Axios versions 1.0.0 through 1.15.1 are vulnerable to a Prototype Pollution Gadget attack, allowing modification of JSON API responses, including privilege escalation and data manipulation.

A vulnerability in the Axios library allows an attacker who can influence the target URL of a request to completely bypass NO_PROXY protection using any address in the 127.0.0.0/8 range (other than 127.0.0.1). This is an incomplete fix for CVE-2025-62718.

A vulnerability in Axios before versions 1.15.1 and 0.31.1 allows a Prototype Pollution attack that causes all HTTP responses (including errors 401, 403, 500) to be treated as success. Authentication and error handling are bypassed.

A vulnerability in Axios versions prior to 1.15.1 and 0.31.1 crashes the Node.js process with a RangeError when processing deeply nested objects in the toFormData function. The lack of recursion depth limit allows an attacker to cause a denial of service (DoS) by sending specially crafted data.

A vulnerability in Axios (versions before 1.15.1 and 0.31.1) allows an attacker to intercept and modify JSON responses or fully hijack HTTP transport if Object.prototype has been polluted by another dependency. The precondition is a separate prototype pollution source in the same process.

A vulnerability in Axios versions prior to 1.15.0 and 0.3.1 allows a gadget-style attack chain where prototype pollution in a third-party dependency can be leveraged to inject unsanitized header values into outbound HTTP requests.

A vulnerability in Axios from version 1.13.0 to 1.13.1. The HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client through concurrent session closures.

The mergeConfig function in Axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger a complete denial of service by providing a malicious configuration object created via JSON.parse().