[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f16OYbzAx4kHmbDpzzvTJl1CKbJXD01tQQYBFOP2U220":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":68,"topProductsByCves":69,"seoMetadata":71,"meta":80},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},2897,"axios",1,8,0,123,"2025-09-12","a",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},11439,"Axios is a technology vendor with 1 tracked product and 8 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,29,35,42,47,51,56,62],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2021-3749","axios is vulnerable to Inefficient Regular Expression Complexity","2021-08-31",7.5,"v3.1","High",false,0.08515,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":24,"cvssVersion":33,"severity":26,"isKev":27,"epssScore":34},"CVE-2019-10742","Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.","2019-05-07","v3.0",0.06145,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":25,"severity":40,"isKev":27,"epssScore":41},"CVE-2020-28168","Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.","2020-11-06",5.9,"Medium",0.02359,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":46},"CVE-2024-39338","axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.","2024-08-12",0.01207,{"cveId":48,"description":49,"publishedDate":13,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":50},"CVE-2025-58754","Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`\u002F`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` \u002F `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.",0.0114,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":55},"CVE-2025-27152","axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.","2025-03-07",0.00792,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":60,"cvssVersion":25,"severity":40,"isKev":27,"epssScore":61},"CVE-2023-45857","An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.","2023-11-08",6.5,0.00556,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":11,"cvssVersion":25,"severity":66,"isKev":27,"epssScore":67},"CVE-2024-57965","In axios before 1.7.8, lib\u002Fhelpers\u002FisURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.","2025-01-29","Unknown",0.00383,[],[70],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":72,"metaDescription":73,"keywords":74,"structuredData":75},"Axios - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Axios covering 1 product with 8 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Axios vulnerabilities, Axios security, Axios CVE, Axios threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":76,"@type":77,"name":78,"description":73,"url":79},"https:\u002F\u002Fschema.org","Organization","Axios","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Faxios",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":81,"apiVersion":82},"2026-10-18T16:40:35.805Z","3.0"]