axios — CVE history (npm)
axios
55 CVEs affect the axios npm package (highest CVSS 9.9). Latest disclosed: 2026-09-28. Full CVE history sourced from NVD.
Summary
- Package
axios(npm)- Total CVEs
55- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.9- Latest disclosed
- 2026-09-28
Recent CVEs (top 20)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-101909 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101908 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101907 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101906 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101905 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101904 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101903 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101902 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101901 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101900 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-101898 | — | — | — | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. |
CVE-2026-67321 | High | 7.5 | — | 2026-08-01 | axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. |
CVE-2026-67320 | High | 7.5 | — | 2026-08-01 | axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. |
CVE-2026-67319 | Low | 3.7 | — | 2026-08-01 | axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. |
CVE-2026-67318 | Medium | 5.3 | — | 2026-08-01 | axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. |
CVE-2026-67317 | High | 7.5 | — | 2026-08-01 | axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. |
CVE-2026-67316 | High | 7.4 | — | 2026-08-01 | axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. |
CVE-2026-67315 | High | 7.5 | — | 2026-08-01 | axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. |
CVE-2026-67314 | Medium | 6.5 | — | 2026-08-01 | axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). |
CVE-2026-67313 | High | 7.5 | — | 2026-08-01 | axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2025-62718 | Critical | 9.9 | — | 2026-04-09 | Axios is a promise based HTTP client for the browser and Node.js. |
CVE-2026-44494 | High | 8.7 | — | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. |
CVE-2026-44492 | High | 8.6 | — | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. |
CVE-2026-67321 | High | 7.5 | — | 2026-08-01 | axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. |
CVE-2026-67320 | High | 7.5 | — | 2026-08-01 | axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. |
CVE-2026-67317 | High | 7.5 | — | 2026-08-01 | axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. |
CVE-2026-67315 | High | 7.5 | — | 2026-08-01 | axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. |
CVE-2026-67313 | High | 7.5 | — | 2026-08-01 | axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. |
CVE-2026-67312 | High | 7.5 | — | 2026-08-01 | axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). |
CVE-2026-44496 | High | 7.5 | — | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. |