Vulnerabilities in axios
41 resultsVexday analysis
O axios apresenta um panorama de risco moderado com 31 vulnerabilidades catalogadas, das quais 22 foram publicadas nos últimos 90 dias, indicando exposição recente significativa. Nenhuma vulnerabilidade crítica (CVSS) ou sob ataque ativo foi identificada, porém a concentração de falhas em CWE-1321 (Improperly Controlled Modification of Object Attributes) sugere padrões de codificação recorrentes que demandam atenção. O volume recente de divulgações justifica monitoramento contínuo e priorização de atualização.
CVE-2026-67318MEDIUMaxios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2EPSS 0.6%CVE-2026-67317MEDIUMaxios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamEPSS 0.6%CVE-2026-42043HIGHAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0EPSS 0.6%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.5%CVE-2026-67320HIGHaxios before 0.33.0 Prototype Pollution via Node HTTP adapterEPSS 0.5%CVE-2026-67312MEDIUMaxios 0.28.0 before 0.33.0 Denial of Service via formToJSONEPSS 0.5%CVE-2026-67313MEDIUMaxios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONEPSS 0.5%CVE-2026-42036MEDIUMAxios: HTTP adapter streamed responses bypass maxContentLengthEPSS 0.5%CVE-2026-42034MEDIUMAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0EPSS 0.5%CVE-2026-67315MEDIUMaxios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0EPSS 0.5%CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.4%CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%CVE-2026-44490MEDIUMAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsEPSS 0.4%CVE-2024-57965NONEIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted sEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%CVE-2026-42038MEDIUMAxios: no_proxy bypass via IP alias allows SSRFEPSS 0.4%CVE-2026-42037MEDIUMAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamEPSS 0.3%CVE-2026-42042MEDIUMAxios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionEPSS 0.3%CVE-2026-67319MEDIUMaxios before 0.33.0 Prototype Pollution via nested option objectsEPSS 0.3%CVE-2026-44489LOWAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixEPSS 0.3%