axios

1.20.0 · 26 Aug 2026MIT66.6M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	1.20.0	Safe from 1.20.0
	0.34.0	No known advisory
	0.33.0	2 open advisories, worst high
	0.32.0	9 open advisories, worst high
	0.31.1	14 open advisories, worst high
	0.30.4	24 open advisories, worst high
	0.29.0	701 open advisories, worst high · last release Nov 2024, no longer updated

Your version

High
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionGHSA-m8m8-qj5v-23w3 · 30 Sep 2026
- 1.x1.15.2 – 1.19.0Fixed in 1.20.0
High
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFGHSA-r4gj-5m52-g5wh · 30 Sep 2026
- 1.x1.17.0 – 1.19.0Fixed in 1.20.0
High
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)GHSA-c29m-xwm3-cm6r · 30 Sep 2026
- 1.x1.16.1 – 1.19.0Fixed in 1.20.0
High
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect LocationGHSA-mghh-pgcx-3jjj · 30 Sep 2026
- 1.x1.15.0 – 1.19.0Fixed in 1.20.0
High
Axios: Prototype Pollution Gadget in axios toFormData OptionsGHSA-x97p-jq2g-jp4f · 30 Sep 2026
- 1.x1.15.1 – 1.19.0Fixed in 1.20.0
- 0.33.x0.33.0No fix on 0.33.x · move to 1.20.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.20.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.20.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.20.0
- 0.29.x and older0.28.0 – 0.29.0No fix, no longer updated · move to 1.20.0
High
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsGHSA-3pq3-5fj3-cg6v · 30 Sep 2026
- 1.x1.13.0 – 1.19.0Fixed in 1.20.0
High
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session InitializationGHSA-542g-h47m-68v8 · 30 Sep 2026
- 1.x1.13.0 – 1.19.0Fixed in 1.20.0
High
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningGHSA-gcfj-64vw-6mp9 · 20 Jul 2026
- 1.x1.15.2 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.1No fix on 0.31.x · move to 1.18.0
High
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionGHSA-hfxv-24rg-xrqf · 4 Jun 2026
- 1.x1.0.0 – 1.15.2Fixed in 1.16.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.16.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.16.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.16.0
High
Allocation of Resources Without Limits or Throttling in AxiosGHSA-777c-7fjr-54vf · 4 Jun 2026
- 1.x1.7.0 – 1.15.2Fixed in 1.16.0
High
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterGHSA-p92q-9vqr-4j8v · 4 Jun 2026
- 1.x1.0.0 – 1.15.2Fixed in 1.16.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.16.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.16.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.16.0
High
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionGHSA-j5f8-grm9-p9fc · 4 Jun 2026
- 1.x1.0.0 – 1.15.2Fixed in 1.16.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.16.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.16.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.16.0
High
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeGHSA-3g43-6gmg-66jw · 29 May 2026
- 1.x1.0.0 – 1.15.1Fixed in 1.15.2
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.19.0 – 0.29.0No fix, no longer updated · move to 0.31.1
High
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`GHSA-35jp-ww65-95wh · 29 May 2026
- 1.x1.0.0 – 1.15.2Fixed in 1.16.0
High
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)GHSA-pjwm-pj3p-43mv · 29 May 2026
- 1.x1.15.0 – 1.15.2Fixed in 1.16.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.16.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.16.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.16.0
High
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingGHSA-pf86-5x62-jrwf · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
High
Axios: Header Injection via Prototype PollutionGHSA-6chq-wfr3-2hj9 · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
High
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0GHSA-pmwg-cvhr-8vh7 · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
High
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijackingGHSA-q8qp-cvcw-x6jj · 5 May 2026
- 1.x1.0.0 – 1.15.1Fixed in 1.15.2
High
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfigGHSA-43fc-jf86-j433 · 9 Feb 2026
- 1.x1.0.0 – 1.13.4Fixed in 1.13.5
- 0.30.x0.30.0 – 0.30.2Fixed in 0.30.3
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.30.3
High
Axios is vulnerable to DoS attack through lack of data size checkGHSA-4hjh-wcwx-xvwj · 11 Sep 2025
- 1.x1.0.0 – 1.11.0Fixed in 1.12.0
- 0.30.x0.30.0 – 0.30.1Fixed in 0.30.2
- 0.29.x and older0.28.0 – 0.29.0No fix, no longer updated · move to 0.30.2
High
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLGHSA-jr5f-v2jv-69x6 · 7 Mar 2025
- 1.x1.0.0 – 1.8.1Fixed in 1.8.2
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.8.2
High
Server-Side Request Forgery in axiosGHSA-8hc4-vh64-cxmj · 12 Aug 2024
- 1.x1.3.2 – 1.7.3Fixed in 1.7.4
High
axios Inefficient Regular Expression Complexity vulnerabilityGHSA-cph5-m8f7-6c5x · 1 Sep 2021
- 0.21.x0.21.0 – 0.21.1Fixed in 0.21.2
- 0.20.x and older0.1.0 – 0.20.0No fix, no longer updated · move to 0.21.2
High
Denial of Service in axiosGHSA-42xw-2xvc-qx8m · 29 May 2019
- 0.18.x0.18.0Fixed in 0.18.1
- 0.17.x and older0.1.0 – 0.17.1No fix, no longer updated · move to 0.18.1
Moderate
Axios: Header Injection via Inherited headers After Minimal InterceptorGHSA-j8rh-479h-cp32 · 30 Sep 2026
- 1.x1.0.0 – 1.19.0Fixed in 1.20.0
Moderate
Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersGHSA-4hqw-qxg8-jxx2 · 30 Sep 2026
- 1.x1.12.0 – 1.19.0Fixed in 1.20.0
Moderate
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesGHSA-44g4-m2mj-wpvx · 30 Sep 2026
- 1.x1.15.0 – 1.19.0Fixed in 1.20.0
Moderate
Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsGHSA-vh66-26gq-q6x8 · 30 Sep 2026
- 1.x1.7.0 – 1.19.0Fixed in 1.20.0
Moderate
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP MethodGHSA-9fr6-4gfg-395g · 30 Sep 2026
- 1.x1.0.0 – 1.19.0Fixed in 1.20.0
- 0.33.x0.33.0No fix on 0.33.x · move to 1.20.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.20.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.20.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.20.0
- 0.29.x and older0.27.2 – 0.29.0No fix, no longer updated · move to 1.20.0
Moderate
Axios form serializer maxDepth bypass via {} metatokenGHSA-hcpx-6fm6-wx23 · 20 Jul 2026
- 1.x1.15.1 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.1No fix on 0.31.x · move to 1.18.0
Moderate
Axios: Nested axios option objects can consume polluted prototype valuesGHSA-7q8q-rj6j-mhjq · 20 Jul 2026
- 1.x1.0.0 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.18.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.18.0
- 0.29.x and older0.8.0 – 0.29.0No fix, no longer updated · move to 1.18.0
Moderate
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-mwf2-3pr3-8698 · 20 Jul 2026
- 1.x1.13.0 – 1.17.0Fixed in 1.18.0
Moderate
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-jqh4-m9w3-8hp9 · 20 Jul 2026
- 1.x1.7.0 – 1.17.0Fixed in 1.18.0
Moderate
Axios: Prototype pollution gadgets can alter axios request constructionGHSA-mmx7-hfxf-jppx · 20 Jul 2026
- 1.x1.0.0 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.18.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.18.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.18.0
Moderate
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosGHSA-f4gw-2p7v-4548 · 20 Jul 2026
- 1.x1.15.0 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.18.0
Moderate
Axios: Excessive recursion in formDataToJSON can cause denial of serviceGHSA-42h9-826w-cgv3 · 20 Jul 2026
- 1.x1.0.0 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.18.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.18.0
- 0.29.x and older0.28.0 – 0.29.0No fix, no longer updated · move to 1.18.0
Moderate
Axios: Prototype pollution auth subfields can inject Basic authGHSA-xj6q-8x83-jv6g · 20 Jul 2026
- 1.x1.15.2 – 1.17.0Fixed in 1.18.0
Moderate
Axios: Deep formToJSON Key Recursion Can Cause Denial of ServiceGHSA-pmv8-rq9r-6j72 · 20 Jul 2026
- 1.x1.0.0 – 1.17.0Fixed in 1.18.0
- 0.32.x0.32.0No fix on 0.32.x · move to 1.18.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.18.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.18.0
- 0.29.x and older0.28.0 – 0.29.0No fix, no longer updated · move to 1.18.0
Moderate
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsGHSA-898c-q2cr-xwhg · 29 May 2026
- 1.x1.0.0 – 1.15.2Fixed in 1.16.0
- 0.31.x0.31.0 – 0.31.1No fix on 0.31.x · move to 1.16.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.16.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.16.0
Moderate
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamGHSA-445q-vr5w-6q77 · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
Moderate
Axios: no_proxy bypass via IP alias allows SSRFGHSA-m7pr-hjqh-92cm · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Moderate
Axios: unbounded recursion in toFormData causes DoS via deeply nested request dataGHSA-62hf-57xw-28j9 · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Moderate
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0GHSA-5c9x-8gcm-mpgx · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Moderate
Axios: HTTP adapter streamed responses bypass maxContentLengthGHSA-vf2m-468p-8v99 · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Moderate
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionGHSA-xx6v-rp6x-q39c · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Moderate
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyGHSA-w9j2-pvgh-6h63 · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Moderate
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`GHSA-3w6x-2g7m-8v23 · 5 May 2026
- 1.x1.0.0 – 1.15.1Fixed in 1.15.2
Moderate
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainGHSA-fvcv-3m26-pcqx · 10 Apr 2026
- 1.x1.0.0 – 1.14.1Fixed in 1.15.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.15.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.15.0
Moderate
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFGHSA-3p68-rc4w-qgx5 · 9 Apr 2026
- 1.x1.0.0 – 1.14.1Fixed in 1.15.0
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 1.15.0
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 1.15.0
Moderate
Axios HTTP/2 Session Cleanup State Corruption VulnerabilityGHSA-qj83-cq47-w5f8 · 8 Apr 2026
- 1.x1.13.0 – 1.13.1Fixed in 1.13.2
Moderate
Axios Cross-Site Request Forgery VulnerabilityGHSA-wf5p-g6vw-rhxx · 8 Nov 2023
- 1.x1.0.0 – 1.5.1Fixed in 1.6.0
- 0.27.x and older0.8.1 – 0.27.2No fix, no longer updated · move to 1.6.0
Moderate
Axios vulnerable to Server-Side Request ForgeryGHSA-4w2v-q235-vp99 · 4 Jan 2021
- 0.21.x0.21.0Fixed in 0.21.1
- 0.20.x and older0.1.0 – 0.20.0No fix, no longer updated · move to 0.21.1
Low
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixGHSA-654m-c8p4-x5fp · 29 May 2026
- 1.x1.15.2Fixed in 1.16.0
Low
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsGHSA-xhjh-pmcv-23jw · 5 May 2026
- 1.x1.0.0 – 1.15.0Fixed in 1.15.1
- 0.31.x0.31.0Fixed in 0.31.1
- 0.30.x0.30.0 – 0.30.4No fix on 0.30.x · move to 0.31.1
- 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated · move to 0.31.1
Malicious
Malicious code in axios (npm)MAL-2026-2307 · 31 Mar 2026
Named versions only: 0.30.4 · 1.14.1. 1.20.0 is safe.

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.