Live data from GitHub and npm, updated daily.
Data last fetched: 2026-10-22
10 active CVEs reported via OSV.dev
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Axios: Excessive recursion in formDataToJSON can cause denial of service
Denial of Service in axios
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Other Developer Tools projects in the Node.js ecosystem worth evaluating.
Get SLA-backed support, security patches, and direct access to senior engineers for Axios — without relying on volunteer maintainers.