Packages / axios / Security

ModerateVulnerabilityGHSA-4w2v-q235-vp99CVE-2020-28168Published 4 Jan 2021

Axios vulnerable to Server-Side Request Forgery

Affected releases · axios

  • 0.21.x0.21.0Fixed in 0.21.1
  • 0.20.x and older0.1.0 – 0.20.0No fix, no longer updated

On 0.21.x, the newest line:

npm install axios@0.21.1
1.x

  1. Not affected

    1.0.0 – 1.20.0

    71 releases, latest

0.x

  1. Affected

    0.1.0 – 0.21.0

    43 releases

  2. Fixed

    0.21.1 – 0.34.0

    26 releases

140 stable releases of axios, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

What happens

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.