Vulnerabilities in axios
31 resultsCVE-2026-42034MEDIUMAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0EPSS 0.3%CVE-2026-44486HIGHAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionEPSS 0.3%CVE-2026-42038MEDIUMAxios: no_proxy bypass via IP alias allows SSRFEPSS 0.3%CVE-2026-42041MEDIUMAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyEPSS 0.3%CVE-2026-44490MEDIUMAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsEPSS 0.3%CVE-2026-42044MEDIUMAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`EPSS 0.3%CVE-2026-42037MEDIUMAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamEPSS 0.2%CVE-2026-42042MEDIUMAxios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionEPSS 0.2%CVE-2026-44489LOWAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixEPSS 0.2%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.2%CVE-2026-42040LOWAxios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsEPSS 0.2%