Vulnerabilidades em axios
53 resultadosAnálise Vexday
O axios apresenta um panorama de risco moderado com 31 vulnerabilidades catalogadas, das quais 22 foram publicadas nos últimos 90 dias, indicando exposição recente significativa. Nenhuma vulnerabilidade crítica (CVSS) ou sob ataque ativo foi identificada, porém a concentração de falhas em CWE-1321 (Improperly Controlled Modification of Object Attributes) sugere padrões de codificação recorrentes que demandam atenção. O volume recente de divulgações justifica monitoramento contínuo e priorização de atualização.
CVE-2026-67318MEDIUMaxios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2EPSS 0.6%CVE-2026-67317MEDIUMaxios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamEPSS 0.6%CVE-2026-44486HIGHAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionEPSS 0.6%CVE-2026-101900MEDIUMAxios: Fetch Adapter Header Injection via Inherited FormData getHeadersEPSS 0.5%CVE-2026-101898HIGHAxios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsEPSS 0.5%CVE-2026-101901HIGHAxios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session InitializationEPSS 0.5%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.5%CVE-2026-67320HIGHaxios before 0.33.0 Prototype Pollution via Node HTTP adapterEPSS 0.5%CVE-2026-67313MEDIUMaxios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONEPSS 0.5%CVE-2026-67312MEDIUMaxios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSONEPSS 0.5%CVE-2026-101899MEDIUMAxios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesEPSS 0.5%CVE-2026-101909HIGHAxios: Prototype Pollution Gadget in axios toFormData OptionsEPSS 0.5%CVE-2026-101904MEDIUMAxios: Header Injection via Inherited headers After Minimal InterceptorEPSS 0.5%CVE-2026-101907HIGHAxios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFEPSS 0.5%CVE-2026-101908MEDIUMAxios: Prototype pollution gadget in fetch adapter can alter outbound requestsEPSS 0.5%CVE-2026-101906HIGHAxios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect LocationEPSS 0.5%CVE-2026-67315MEDIUMaxios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0EPSS 0.5%CVE-2026-101903HIGHAxios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)EPSS 0.4%CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.4%CVE-2026-101905HIGHAxios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionEPSS 0.4%