Search for packages
| purl | pkg:npm/axios@1.16.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-51c7-v6tb-rydk | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
CVE-2026-44494
GHSA-35jp-ww65-95wh |
| VCID-6zwg-zgr2-2qfw | Allocation of Resources Without Limits or Throttling in Axios |
CVE-2026-44488
GHSA-777c-7fjr-54vf |
| VCID-7ayb-d1sc-kqhn | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter |
CVE-2026-44487
GHSA-p92q-9vqr-4j8v |
| VCID-8vwd-zh7x-d3dh | Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix |
CVE-2026-44489
GHSA-654m-c8p4-x5fp |
| VCID-bwhx-3sqd-sbdt | axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) |
CVE-2026-44492
GHSA-pjwm-pj3p-43mv |
| VCID-mxxd-29jn-n3hz | axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions |
CVE-2026-44490
GHSA-898c-q2cr-xwhg |
| VCID-qzgk-6jrw-5bej | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection |
CVE-2026-44496
GHSA-hfxv-24rg-xrqf |
| VCID-tqqm-t9ab-vfec | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection |
CVE-2026-44486
GHSA-j5f8-grm9-p9fc |