# Axios vulnerabilities Source: https://junglewise.ai/threats/technologies/axios Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/axios.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 69 vulnerabilities in Axios: 0 in the last 7 days and 12 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-101899, was published on 13 October 2026. 1 vulnerability in the last four weeks, down 91% on the four before (11). ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 12 - All time: 69 (2 critical, 0 exploited in the wild) ## About Axios Axios is a JavaScript HTTP client library for making asynchronous requests to APIs. ## Latest Axios vulnerabilities - [CVE-2026-101899: Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy) (medium, CVSS 4, published 13 Oct 2026) - [CVE-2026-101909: Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [CVE-2026-101908: Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101907: Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [CVE-2026-101906: Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [CVE-2026-101905: Axios HTTP adapter prototype pollution leading to man-in-the-middle](https://junglewise.ai/threats/cve-2026-101905-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [CVE-2026-101904: Axios prototype pollution in request header handling](https://junglewise.ai/threats/cve-2026-101904-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101903: Axios regular expression denial of service in data URL parsing](https://junglewise.ai/threats/cve-2026-101903-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [CVE-2026-101902: Axios prototype pollution read-side gadget in request dispatch](https://junglewise.ai/threats/cve-2026-101902-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101901: Axios unhandled Http2Session error denial of service](https://junglewise.ai/threats/cve-2026-101901-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [CVE-2026-101900: Axios prototype pollution via inherited FormData properties](https://junglewise.ai/threats/cve-2026-101900-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (medium, CVSS 4, published 28 Sep 2026) - [CVE-2026-101898: Axios HTTP/2 request proxy and DNS lookup policy bypass](https://junglewise.ai/threats/cve-2026-101898-axios-is-a-promise-based-http-client-for-the-browser-and-node-js) (high, CVSS 4, published 28 Sep 2026) - [Axios form serializer maxDepth bypass via {} metatoken](https://junglewise.ai/threats/axios-form-serializer-maxdepth-bypass-via-metatoken-a3285ce5) (high, CVSS 7.5, published 1 Aug 2026) - [Axios Node HTTP adapter proxy injection via prototype pollution](https://junglewise.ai/threats/axios-node-http-adapter-proxy-injection-via-prototype-pollution-ce5dbbad) (high, CVSS 7.5, published 1 Aug 2026) - [Axios nested option objects prototype pollution gadget](https://junglewise.ai/threats/axios-nested-option-objects-prototype-pollution-gadget-b2852cf7) (low, CVSS 3.7, published 1 Aug 2026) - [Axios NO_PROXY bypass for 0.0.0.0 local addresses](https://junglewise.ai/threats/axios-no-proxy-bypass-for-0-0-0-0-local-addresses-1c64658e) (high, CVSS 7.5, published 1 Aug 2026) - [Axios excessive recursion in formDataToJSON denial of service](https://junglewise.ai/threats/axios-excessive-recursion-in-formdatatojson-denial-of-service-3c93895e) (high, CVSS 7.5, published 1 Aug 2026) - [Axios prototype pollution in Basic auth subfield handling](https://junglewise.ai/threats/axios-prototype-pollution-in-basic-auth-subfield-handling-84a58e9b) (medium, CVSS 6.3, published 1 Aug 2026) - [Axios HTTP/2 streamed uploads bypass maxBodyLength](https://junglewise.ai/threats/axios-http-2-streamed-uploads-bypass-maxbodylength-4f7ce9e1) (medium, CVSS 5.3, published 1 Aug 2026) - [Axios fetch adapter ReadableStream uploads bypass maxBodyLength](https://junglewise.ai/threats/axios-fetch-adapter-readablestream-uploads-bypass-maxbodylength-91701c14) (high, CVSS 7.5, published 1 Aug 2026) - [Axios uncontrolled recursion in formDataToJSON denial of service](https://junglewise.ai/threats/axios-uncontrolled-recursion-in-formdatatojson-denial-of-service-99f685fa) (medium, CVSS 6.3, published 1 Aug 2026) - [CVE-2026-67321: Axios form serializer maxDepth bypass via {} metatoken](https://junglewise.ai/threats/cve-2026-67321-axios-form-serializer-maxdepth-bypass-via-metatoken) (high, CVSS 7.5, published 1 Aug 2026) - [CVE-2026-67320: axios Node HTTP adapter proxy inheritance via interceptor cloning](https://junglewise.ai/threats/cve-2026-67320-axios-node-http-adapter-proxy-inheritance-via-interceptor-cloning) (high, CVSS 7.5, published 1 Aug 2026) - [CVE-2026-67319: axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the…](https://junglewise.ai/threats/cve-2026-67319-axios-prototype-pollution-via-nested-option-objects) (medium, CVSS 4, published 1 Aug 2026) - [CVE-2026-67318: Axios HTTP/2 streamed uploads bypass maxBodyLength](https://junglewise.ai/threats/cve-2026-67318-axios-http-2-streamed-uploads-bypass-maxbodylength) (medium, CVSS 5.3, published 1 Aug 2026) ## Most severe Axios vulnerabilities - [CVE-2025-62718: Axios hostname normalization proxy bypass and SSRF](https://junglewise.ai/threats/cve-2025-62718-axios-hostname-normalization-proxy-bypass-and-ssrf) (critical, CVSS 9.9, published 9 Apr 2026) - [CVE-2026-34841: Axios npm supply chain attack via @usebruno/cli](https://junglewise.ai/threats/cve-2026-34841-axios-npm-supply-chain-attack-via-usebruno-cli) (critical, CVSS 9.8, published 6 Apr 2026) - [CVE-2026-44494: Axios Prototype Pollution Gadget in Node Proxy Handling](https://junglewise.ai/threats/cve-2026-44494-axios-prototype-pollution-gadget-in-node-proxy-handling) (high, CVSS 8.7, published 11 Jun 2026) - [CVE-2026-44492: Axios SSRF via IPv4-mapped IPv6 NO_PROXY bypass](https://junglewise.ai/threats/cve-2026-44492-axios-ssrf-via-ipv4-mapped-ipv6-no-proxy-bypass) (high, CVSS 8.6, published 11 Jun 2026) - [CVE-2026-25639: Axios denial of service in mergeConfig](https://junglewise.ai/threats/cve-2026-25639-axios-denial-of-service-in-mergeconfig) (high, CVSS 7.5, published 9 Feb 2026) - [CVE-2026-44496: Axios ReDoS via unsanitized XSRF cookie name](https://junglewise.ai/threats/cve-2026-44496-axios-redos-via-unsanitized-xsrf-cookie-name) (high, CVSS 7.5, published 11 Jun 2026) - [CVE-2026-42039: Axios unbounded recursion denial of service in toFormData](https://junglewise.ai/threats/cve-2026-42039-axios-unbounded-recursion-denial-of-service-in-toformdata) (high, CVSS 7.5, published 24 Apr 2026) - [CVE-2026-44488: Axios resource exhaustion via size limit bypass in fetch adapter](https://junglewise.ai/threats/cve-2026-44488-axios-resource-exhaustion-via-size-limit-bypass-in-fetch-adapter) (high, CVSS 7.5, published 11 Jun 2026) - [CVE-2026-40895: follow-redirects sensitive header leak in cross-domain redirects](https://junglewise.ai/threats/cve-2026-40895-follow-redirects-sensitive-header-leak-in-cross-domain-redirects) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2026-44486: Axios information exposure via Proxy-Authorization header leak](https://junglewise.ai/threats/cve-2026-44486-axios-information-exposure-via-proxy-authorization-header-leak) (high, CVSS 7.5, published 11 Jun 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 91% on the four before (11). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 11 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Axios vulnerabilities", https://junglewise.ai/threats/technologies/axios, 13 November 2026.