Sign in
Deutsch English Español Polski
Medium

Axios Cross-Site Request Forgery Vulnerability

  • Disclosed: 08.11.2023
  • Updated: 11.10.2026 10:22

An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package axios >= 1.0.0, < 1.6.0, >= 0.8.1, < 0.28.0 1.6.0, 0.28.0

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-352
Platform
npm
Package
axios
Disclosed
08.11.2023
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-wf5p-g6vw-rhxx - CC BY 4.0

Vulnerability history: axios

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (55) in the archive
Total entries
55
First → latest
05.2019 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 25
  • Medium 28
  • Low 2

Disclosures per year

Severity:
  1. Axios Cross-Site Request Forgery Vulnerability this entry
    Medium · 6.5 CVE-2023-45857 >= 1.0.0, < 1.6.0, >= 0.8.1, < 0.28.0 1.6.0, 0.28.0
  2. Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
    High CVE-2026-101905 >= 1.15.2, < 1.20.0 1.20.0
  3. Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
    High CVE-2026-101907 >= 1.17.0, < 1.20.0 1.20.0
  4. Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
    High CVE-2026-101903 >= 1.16.1, < 1.20.0 1.20.0
  5. Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
    High CVE-2026-101906 >= 1.15.0, < 1.20.0 1.20.0
  6. Axios: Prototype Pollution Gadget in axios toFormData Options
    High CVE-2026-101909 >= 0.28.0, < 0.34.0, >= 1.15.1, < 1.20.0 0.34.0, 1.20.0
  7. Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
    High CVE-2026-101898 >= 1.13.0, < 1.20.0 1.20.0
  8. Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
    High CVE-2026-101901 >= 1.13.0, < 1.20.0 1.20.0
  9. Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
    High CVE-2026-67320 >= 0.31.1, < 0.33.0, >= 1.15.2, < 1.18.0 0.33.0, 1.18.0
  10. Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
    High · 7.5 CVE-2026-44496 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  11. Allocation of Resources Without Limits or Throttling in Axios
    High · 7.5 CVE-2026-44488 >= 1.7.0, < 1.16.0 1.16.0
  12. Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
    High CVE-2026-44487 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  13. Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
    High · 7.5 CVE-2026-44486 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  14. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
    High · 7.0 CVE-2026-44495 >= 1.0.0, < 1.15.2, >= 0.19.0, < 0.31.1 1.15.2, 0.31.1
  15. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
    High · 8.7 CVE-2026-44494 >= 1.0.0, < 1.16.0 1.16.0
  16. axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
    High · 8.6 CVE-2026-44492 >= 1.15.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  17. Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
    High · 7.4 CVE-2026-42033 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  18. Axios: Header Injection via Prototype Pollution
    High · 7.4 CVE-2026-42035 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  19. Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
    High · 7.2 CVE-2026-42043 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  20. Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
    High · 7.4 CVE-2026-42264 >= 1.0.0, < 1.15.2 1.15.2
  21. Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
    High · 7.5 CVE-2026-25639 >= 1.0.0, < 1.13.5, < 0.30.3 1.13.5, 0.30.3
Show more (5) Showing 21 of 26

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.