AIKIDO-2026-38469
axios is vulnerable to Server-Side Request Forgery (SSRF)
59
Medium Risk
This Affects:
axiosTL;DR
Before adapter normalization, axios accepted malformed http: and https: URLs that omitted //, such as https:internal.example, which could evade naive allowlist or WAF checks and reach unintended hosts. The library silently normalized these inputs instead of rejecting them. The fix throws AxiosError with ERR_INVALID_URL for malformed scheme URLs such as https:example.com or http:/example.com before adapter normalization occurs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
axios is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.19.1 - 1.17.0.
How to fix this
Upgrade the axios library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant