Packages / axios / Security

ModerateVulnerabilityGHSA-wf5p-g6vw-rhxxCVE-2023-45857Published 8 Nov 2023

Axios Cross-Site Request Forgery Vulnerability

Affected releases · axios

  • 1.x1.0.0 – 1.5.1Fixed in 1.6.0
  • 0.27.x and older0.8.1 – 0.27.2No fix, no longer updated

On 1.x, the newest line:

npm install axios@1.6.0
1.x

  1. Affected

    1.0.0 – 1.5.1

    22 releases

  2. Fixed

    1.6.0 – 1.20.0

    49 releases, latest

0.x

  1. Not affected

    0.1.0 – 0.8.0

    17 releases

  2. Affected

    0.8.1 – 0.27.2

    39 releases

  3. Fixed

    0.28.0 – 0.34.0

    13 releases

140 stable releases of axios, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

What happens

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.