Packages / axios / Security

HighVulnerabilityGHSA-8hc4-vh64-cxmjCVE-2024-39338Published 12 Aug 2024

Server-Side Request Forgery in axios

Affected releases · axios

  • 1.x1.3.2 – 1.7.3Fixed in 1.7.4

On 1.x, the newest line:

npm install axios@1.7.4

  1. Not affected

    0.1.0 – 1.3.1

    83 releases

  2. Affected

    1.3.2 – 1.7.3

    21 releases

  3. Fixed

    1.7.4 – 1.20.0

    36 releases, latest

140 stable releases of axios, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

What happens

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.