Description
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 0.21.1+dfsg-1 | — |
| Debian 13 | node-axios | 0.21.1+dfsg-1 | — |
| Debian 12 | node-axios | 0.21.1+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-axios | No fix yet | — |
| Ubuntu 25.10 | node-axios | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | < 0.21.1 | 0.21.1 | GHSA-4w2v-q235-vp99 |
Advisories 3
- ICSA-24-277-02 Subnet Solutions Inc. PowerSYSTEM Center CISA ICS & IT advisories · Oct 1, 2024
- ICSA-22-258-05 Siemens SINEC INS CISA ICS & IT advisories · Sep 13, 2022
- SSA-637483 SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 Siemens ProductCERT · Sep 13, 2022
References
- https://github.com/axios/axios/issues/3369
- [druid-commits] 20210107 [GitHub] [druid] jon-wei opened a new pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052 mailing-list
- [druid-commits] 20210107 [GitHub] [druid] clintropolis merged pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052 mailing-list
- [druid-commits] 20210127 [druid] 01/02: Update deps for CVE-2020-28168 and CVE-2020-28052 (#10733) mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf