Vulnerabilidades en axios
41 resultadosAnálisis Vexday
O axios apresenta um panorama de risco moderado com 31 vulnerabilidades catalogadas, das quais 22 foram publicadas nos últimos 90 dias, indicando exposição recente significativa. Nenhuma vulnerabilidade crítica (CVSS) ou sob ataque ativo foi identificada, porém a concentração de falhas em CWE-1321 (Improperly Controlled Modification of Object Attributes) sugere padrões de codificação recorrentes que demandam atenção. O volume recente de divulgações justifica monitoramento contínuo e priorização de atualização.
CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.5%CVE-2026-42036MEDIUMAxios: HTTP adapter streamed responses bypass maxContentLengthEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%CVE-2024-57965NONEIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted sEPSS 0.4%CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%CVE-2026-67317MEDIUMaxios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamEPSS 0.4%CVE-2026-67318MEDIUMaxios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2EPSS 0.4%CVE-2026-67312MEDIUMaxios 0.28.0 before 0.33.0 Denial of Service via formToJSONEPSS 0.3%CVE-2026-67313MEDIUMaxios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONEPSS 0.3%CVE-2026-42034MEDIUMAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0EPSS 0.3%CVE-2026-67320HIGHaxios before 0.33.0 Prototype Pollution via Node HTTP adapterEPSS 0.3%CVE-2026-42038MEDIUMAxios: no_proxy bypass via IP alias allows SSRFEPSS 0.3%CVE-2026-42037MEDIUMAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamEPSS 0.3%CVE-2026-67315MEDIUMaxios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0EPSS 0.3%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.3%CVE-2026-44490MEDIUMAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsEPSS 0.3%CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.3%CVE-2026-67319MEDIUMaxios before 0.33.0 Prototype Pollution via nested option objectsEPSS 0.3%CVE-2026-44489LOWAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixEPSS 0.2%CVE-2026-42042MEDIUMAxios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionEPSS 0.2%