axios vulnerabilities and security advisories

$ latest 30 · 25 critical, high or exploited

• mediumSep 30, 2026

  Axios: Header Injection via Inherited headers After Minimal Interceptor

  • axios >= 1.0.0, < 1.20.0 · fixed in 1.20.0
  GHSA-j8rh-479h-cp32CVE-2026-101904

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-j8rh-479h-cp32 (CVE-2026-101904), severity medium
  What it is: Axios: Header Injection via Inherited headers After Minimal Interceptor
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-j8rh-479h-cp32
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumSep 30, 2026

  Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

  • axios >= 1.12.0, < 1.20.0 · fixed in 1.20.0
  GHSA-4hqw-qxg8-jxx2CVE-2026-101900

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-4hqw-qxg8-jxx2 (CVE-2026-101900), severity medium
  What it is: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
  Affected packages:
  - axios: affected versions >= 1.12.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-4hqw-qxg8-jxx2
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

  • axios >= 1.15.2, < 1.20.0 · fixed in 1.20.0
  GHSA-m8m8-qj5v-23w3CVE-2026-101905

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-m8m8-qj5v-23w3 (CVE-2026-101905), severity high
  What it is: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
  Affected packages:
  - axios: affected versions >= 1.15.2, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-m8m8-qj5v-23w3
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumSep 30, 2026

  Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

  • axios >= 1.15.0, < 1.20.0 · fixed in 1.20.0
  GHSA-44g4-m2mj-wpvxCVE-2026-101899

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-44g4-m2mj-wpvx (CVE-2026-101899), severity medium
  What it is: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
  Affected packages:
  - axios: affected versions >= 1.15.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-44g4-m2mj-wpvx
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

  • axios >= 1.17.0, < 1.20.0 · fixed in 1.20.0
  GHSA-r4gj-5m52-g5whCVE-2026-101907

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-r4gj-5m52-g5wh (CVE-2026-101907), severity high
  What it is: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
  Affected packages:
  - axios: affected versions >= 1.17.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-r4gj-5m52-g5wh
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumSep 30, 2026

  Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

  • axios >= 1.7.0, < 1.20.0 · fixed in 1.20.0
  GHSA-vh66-26gq-q6x8CVE-2026-101908

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-vh66-26gq-q6x8 (CVE-2026-101908), severity medium
  What it is: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
  Affected packages:
  - axios: affected versions >= 1.7.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-vh66-26gq-q6x8
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumSep 30, 2026

  Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

  • axios >= 0.27.2, < 0.34.0 · fixed in 0.34.0
  • axios >= 1.0.0, < 1.20.0 · fixed in 1.20.0
  GHSA-9fr6-4gfg-395gCVE-2026-101902

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-9fr6-4gfg-395g (CVE-2026-101902), severity medium
  What it is: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
  Affected packages:
  - axios: affected versions >= 0.27.2, < 0.34.0. Fixed in 0.34.0.
  - axios: affected versions >= 1.0.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-9fr6-4gfg-395g
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

  • axios >= 1.16.1, < 1.20.0 · fixed in 1.20.0
  GHSA-c29m-xwm3-cm6rCVE-2026-101903

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-c29m-xwm3-cm6r (CVE-2026-101903), severity high
  What it is: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
  Affected packages:
  - axios: affected versions >= 1.16.1, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-c29m-xwm3-cm6r
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

  • axios >= 1.15.0, < 1.20.0 · fixed in 1.20.0
  GHSA-mghh-pgcx-3jjjCVE-2026-101906

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-mghh-pgcx-3jjj (CVE-2026-101906), severity high
  What it is: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
  Affected packages:
  - axios: affected versions >= 1.15.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-mghh-pgcx-3jjj
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: Prototype Pollution Gadget in axios toFormData Options

  • axios >= 0.28.0, < 0.34.0 · fixed in 0.34.0
  • axios >= 1.15.1, < 1.20.0 · fixed in 1.20.0
  GHSA-x97p-jq2g-jp4fCVE-2026-101909

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-x97p-jq2g-jp4f (CVE-2026-101909), severity high
  What it is: Axios: Prototype Pollution Gadget in axios toFormData Options
  Affected packages:
  - axios: affected versions >= 0.28.0, < 0.34.0. Fixed in 0.34.0.
  - axios: affected versions >= 1.15.1, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-x97p-jq2g-jp4f
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

  • axios >= 1.13.0, < 1.20.0 · fixed in 1.20.0
  GHSA-3pq3-5fj3-cg6vCVE-2026-101898

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-3pq3-5fj3-cg6v (CVE-2026-101898), severity high
  What it is: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
  Affected packages:
  - axios: affected versions >= 1.13.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-3pq3-5fj3-cg6v
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highSep 30, 2026

  Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

  • axios >= 1.13.0, < 1.20.0 · fixed in 1.20.0
  GHSA-542g-h47m-68v8CVE-2026-101901

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-542g-h47m-68v8 (CVE-2026-101901), severity high
  What it is: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
  Affected packages:
  - axios: affected versions >= 1.13.0, < 1.20.0. Fixed in 1.20.0.
  Details: https://github.com/advisories/GHSA-542g-h47m-68v8
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highJul 20, 2026

  Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

  • axios >= 0.31.1, < 0.33.0 · fixed in 0.33.0
  • axios >= 1.15.2, < 1.18.0 · fixed in 1.18.0
  GHSA-gcfj-64vw-6mp9CVE-2026-67320

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-gcfj-64vw-6mp9 (CVE-2026-67320), severity high
  What it is: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
  Affected packages:
  - axios: affected versions >= 0.31.1, < 0.33.0. Fixed in 0.33.0.
  - axios: affected versions >= 1.15.2, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-gcfj-64vw-6mp9
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios form serializer maxDepth bypass via {} metatoken

  • axios >= 0.31.1, < 0.33.0 · fixed in 0.33.0
  • axios >= 1.15.1, < 1.18.0 · fixed in 1.18.0
  GHSA-hcpx-6fm6-wx23CVE-2026-67321

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-hcpx-6fm6-wx23 (CVE-2026-67321), severity medium
  What it is: Axios form serializer maxDepth bypass via {} metatoken
  Affected packages:
  - axios: affected versions >= 0.31.1, < 0.33.0. Fixed in 0.33.0.
  - axios: affected versions >= 1.15.1, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-hcpx-6fm6-wx23
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: Nested axios option objects can consume polluted prototype values

  • axios >= 0.8.0, < 0.33.0 · fixed in 0.33.0
  • axios >= 1.0.0, < 1.18.0 · fixed in 1.18.0
  GHSA-7q8q-rj6j-mhjqCVE-2026-67319

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-7q8q-rj6j-mhjq (CVE-2026-67319), severity medium
  What it is: Axios: Nested axios option objects can consume polluted prototype values
  Affected packages:
  - axios: affected versions >= 0.8.0, < 0.33.0. Fixed in 0.33.0.
  - axios: affected versions >= 1.0.0, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-7q8q-rj6j-mhjq
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

  • axios >= 1.13.0, < 1.18.0 · fixed in 1.18.0
  GHSA-mwf2-3pr3-8698CVE-2026-67318

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-mwf2-3pr3-8698 (CVE-2026-67318), severity medium
  What it is: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
  Affected packages:
  - axios: affected versions >= 1.13.0, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-mwf2-3pr3-8698
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

  • axios >= 1.7.0, < 1.18.0 · fixed in 1.18.0
  GHSA-jqh4-m9w3-8hp9CVE-2026-67317

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-jqh4-m9w3-8hp9 (CVE-2026-67317), severity medium
  What it is: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
  Affected packages:
  - axios: affected versions >= 1.7.0, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-jqh4-m9w3-8hp9
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: Prototype pollution gadgets can alter axios request construction

  • axios >= 1.0.0, < 1.18.0 · fixed in 1.18.0
  • axios < 0.33.0 · fixed in 0.33.0
  GHSA-mmx7-hfxf-jppxCVE-2026-67316

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-mmx7-hfxf-jppx (CVE-2026-67316), severity medium
  What it is: Axios: Prototype pollution gadgets can alter axios request construction
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.18.0. Fixed in 1.18.0.
  - axios: affected versions < 0.33.0. Fixed in 0.33.0.
  Details: https://github.com/advisories/GHSA-mmx7-hfxf-jppx
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

  • axios >= 1.15.0, < 1.18.0 · fixed in 1.18.0
  • axios >= 0.31.0, < 0.33.0 · fixed in 0.33.0
  GHSA-f4gw-2p7v-4548CVE-2026-67315

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-f4gw-2p7v-4548 (CVE-2026-67315), severity medium
  What it is: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
  Affected packages:
  - axios: affected versions >= 1.15.0, < 1.18.0. Fixed in 1.18.0.
  - axios: affected versions >= 0.31.0, < 0.33.0. Fixed in 0.33.0.
  Details: https://github.com/advisories/GHSA-f4gw-2p7v-4548
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: Excessive recursion in formDataToJSON can cause denial of service

  • axios >= 0.28.0, < 0.33.0 · fixed in 0.33.0
  • axios >= 1.0.0, < 1.18.0 · fixed in 1.18.0
  GHSA-42h9-826w-cgv3CVE-2026-67313

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-42h9-826w-cgv3 (CVE-2026-67313), severity medium
  What it is: Axios: Excessive recursion in formDataToJSON can cause denial of service
  Affected packages:
  - axios: affected versions >= 0.28.0, < 0.33.0. Fixed in 0.33.0.
  - axios: affected versions >= 1.0.0, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-42h9-826w-cgv3
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: Prototype pollution auth subfields can inject Basic auth

  • axios >= 1.15.2, < 1.18.0 · fixed in 1.18.0
  GHSA-xj6q-8x83-jv6gCVE-2026-67314

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-xj6q-8x83-jv6g (CVE-2026-67314), severity medium
  What it is: Axios: Prototype pollution auth subfields can inject Basic auth
  Affected packages:
  - axios: affected versions >= 1.15.2, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-xj6q-8x83-jv6g
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumJul 20, 2026

  Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

  • axios >= 0.28.0, < 0.33.0 · fixed in 0.33.0
  • axios >= 1.0.0, < 1.18.0 · fixed in 1.18.0
  GHSA-pmv8-rq9r-6j72CVE-2026-67312

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-pmv8-rq9r-6j72 (CVE-2026-67312), severity medium
  What it is: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
  Affected packages:
  - axios: affected versions >= 0.28.0, < 0.33.0. Fixed in 0.33.0.
  - axios: affected versions >= 1.0.0, < 1.18.0. Fixed in 1.18.0.
  Details: https://github.com/advisories/GHSA-pmv8-rq9r-6j72
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highJun 4, 2026

  Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

  • axios >= 1.0.0, < 1.16.0 · fixed in 1.16.0
  • axios <= 0.31.1 · fixed in 0.32.0
  GHSA-hfxv-24rg-xrqfCVE-2026-44496

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-hfxv-24rg-xrqf (CVE-2026-44496), severity high
  What it is: Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.16.0. Fixed in 1.16.0.
  - axios: affected versions <= 0.31.1. Fixed in 0.32.0.
  Details: https://github.com/advisories/GHSA-hfxv-24rg-xrqf
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highJun 4, 2026

  Allocation of Resources Without Limits or Throttling in Axios

  • axios >= 1.7.0, < 1.16.0 · fixed in 1.16.0
  GHSA-777c-7fjr-54vfCVE-2026-44488

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-777c-7fjr-54vf (CVE-2026-44488), severity high
  What it is: Allocation of Resources Without Limits or Throttling in Axios
  Affected packages:
  - axios: affected versions >= 1.7.0, < 1.16.0. Fixed in 1.16.0.
  Details: https://github.com/advisories/GHSA-777c-7fjr-54vf
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highJun 4, 2026

  Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

  • axios >= 1.0.0, < 1.16.0 · fixed in 1.16.0
  • axios <= 0.31.1 · fixed in 0.32.0
  GHSA-p92q-9vqr-4j8vCVE-2026-44487

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-p92q-9vqr-4j8v (CVE-2026-44487), severity high
  What it is: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.16.0. Fixed in 1.16.0.
  - axios: affected versions <= 0.31.1. Fixed in 0.32.0.
  Details: https://github.com/advisories/GHSA-p92q-9vqr-4j8v
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highJun 4, 2026

  Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

  • axios >= 1.0.0, < 1.16.0 · fixed in 1.16.0
  • axios <= 0.31.1 · fixed in 0.32.0
  GHSA-j5f8-grm9-p9fcCVE-2026-44486

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-j5f8-grm9-p9fc (CVE-2026-44486), severity high
  What it is: Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.16.0. Fixed in 1.16.0.
  - axios: affected versions <= 0.31.1. Fixed in 0.32.0.
  Details: https://github.com/advisories/GHSA-j5f8-grm9-p9fc
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highMay 29, 2026

  axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

  • axios >= 1.0.0, < 1.15.2 · fixed in 1.15.2
  • axios >= 0.19.0, < 0.31.1 · fixed in 0.31.1
  GHSA-3g43-6gmg-66jwCVE-2026-44495

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-3g43-6gmg-66jw (CVE-2026-44495), severity high
  What it is: axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.15.2. Fixed in 1.15.2.
  - axios: affected versions >= 0.19.0, < 0.31.1. Fixed in 0.31.1.
  Details: https://github.com/advisories/GHSA-3g43-6gmg-66jw
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highMay 29, 2026

  axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

  • axios >= 1.0.0, < 1.16.0 · fixed in 1.16.0
  GHSA-35jp-ww65-95whCVE-2026-44494

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-35jp-ww65-95wh (CVE-2026-44494), severity high
  What it is: axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.16.0. Fixed in 1.16.0.
  Details: https://github.com/advisories/GHSA-35jp-ww65-95wh
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• highMay 29, 2026

  axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

  • axios <= 0.31.1 · fixed in 0.32.0
  • axios >= 1.15.0, < 1.16.0 · fixed in 1.16.0
  GHSA-pjwm-pj3p-43mvCVE-2026-44492

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-pjwm-pj3p-43mv (CVE-2026-44492), severity high
  What it is: axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
  Affected packages:
  - axios: affected versions <= 0.31.1. Fixed in 0.32.0.
  - axios: affected versions >= 1.15.0, < 1.16.0. Fixed in 1.16.0.
  Details: https://github.com/advisories/GHSA-pjwm-pj3p-43mv
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• mediumMay 29, 2026

  axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

  • axios >= 1.0.0, < 1.16.0 · fixed in 1.16.0
  • axios <= 0.31.1 · fixed in 0.32.0
  GHSA-898c-q2cr-xwhgCVE-2026-44490

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-898c-q2cr-xwhg (CVE-2026-44490), severity medium
  What it is: axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
  Affected packages:
  - axios: affected versions >= 1.0.0, < 1.16.0. Fixed in 1.16.0.
  - axios: affected versions <= 0.31.1. Fixed in 0.32.0.
  Details: https://github.com/advisories/GHSA-898c-q2cr-xwhg
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.