AIKIDO-2025-10185
axios is vulnerable to Server-side Request Forgery (SSRF)
62
Medium Risk
This Affects:
axiosTL;DR
Affected versions of this package are vulnerable to server-side request forgery (SSRF) because allowAbsoluteUrls is not set to false by default when processing URLs in buildFullPath(). This unsafe default may lead to unintended URL acceptance, allowing attackers to bypass expected restrictions. As a result, URLs that should be blocked may be processed instead. This vulnerability effectively bypasses the fix for CVE-2025-27152.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
axios is vulnerable to Server-side Request Forgery (SSRF) in versions 0.19.1 - 0.29.0 and 1.0.0 - 1.8.2.
How to fix this
Upgrade the axios library to a patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant