Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
55 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Recommended action: Upgrade to 1.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Recommended action: Upgrade to 1.6.0 or 0.28.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.
Recommended action: Upgrade to 0.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Recommended action: Upgrade to 0.21.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of axios prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the maxContentLength property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service. Recommendation Upgrade to 0.18.1 or later.
Recommended action: Upgrade to 0.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.