AIKIDO-2026-10823
axios is vulnerable to Cleartext Transmission of Sensitive Information via Proxy
75
High Risk
This Affects:
axiosTL;DR
The Node HTTP adapter could treat HTTPS origins like a forward HTTP proxy target, sending the full URL, headers, and request body to the proxy in cleartext instead of opening a CONNECT tunnel and running TLS directly to the server. An HTTP proxy on the path can observe request metadata and payloads that should stay inside the TLS tunnel. The fix tunnels HTTPS through CONNECT and scopes proxy authorization to that handshake. Impact is confidentiality to the proxy leg for apps that rely on env-based HTTP proxies.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application routes HTTPS requests through an HTTP proxy.
Background info
axios is vulnerable to Cleartext Transmission of Sensitive Information via Proxy in versions 1.0.0 - 1.16.0.
How to fix this
Upgrade the axios library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant