Skip to content
OpenAdvisories

Package · Debian

node-axios

56 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-44489

    Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

    Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib…

    axios axios node-axios axios Debian Ubuntu npm
  • Low 3.7
    CVE-2026-42040

    Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes.…

    axios axios node-axios node-axios Debian Ubuntu npm