Description
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.7.4+dfsg-1 | — |
| Debian 13 | node-axios | 1.7.4+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-axios | No fix yet | — |
| Ubuntu 25.10 | node-axios | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | pgadmin4 | 8.5-150600.3.6.1 | SUSE-SU-2024:3771-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git97.675e45f9-12.1 | openSUSE-SU-2024:14282-1 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.6.1 | SUSE-SU-2024:3771-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows | 3.6.5-r2 | — |
| Wolfi rolling | jitsucom-jitsu +2 | 2.8.0-r1 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.9.0-r1 | — |
| Wolfi rolling | kubeflow-pipelines +11 | 2.2.0-r10 | — |
| Wolfi rolling | lerna | 8.1.8-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 1.3.2, < 1.7.4 | 1.7.4 | GHSA-8hc4-vh64-cxmj |
Advisories 14
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2025-0001 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2026-3707 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2026
- WID-SEC-2025-0647 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 9, 2026
- WID-SEC-2024-2036 Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 1, 2026
- WID-SEC-2024-3250 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 8, 2026
- openSUSE-SU-2024:14282-1 velociraptor-0.7.0.4.git97.675e45f9-12.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3771-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-2197 IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Cross-Site Scripting und Server-Side Request Forgery BSI CERT-Bund (WID) · Jan 25, 2026
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0299 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 9, 2025
- WID-SEC-2024-2035 Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Manipulation von Dateien und Denial of Service BSI CERT-Bund (WID) · Nov 12, 2024
- WID-SEC-2024-3325 IBM QRadar SIEM: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 3, 2024
- WID-SEC-2024-2159 IBM License Metric Tool: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2024