github.com/anuraghazra/github-readme-stats
Submitted 8/4/2026, 10:25:55 AM · Status: ok
Risk grade
F
100 / 100
Findings
140
0 critical24 high114 medium2 low0 info0 on CISA KEV0ATT&CK
Showing 140 of 140 findings
Findings
- Allocation of Resources Without Limits or Throttling in AxiosgrypeCVE-2026-44488EPSS 0.6%
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijackinggrypeCVE-2026-42264EPSS 0.7%
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfiggrypeCVE-2026-25639EPSS 2.5%
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergegrypeCVE-2026-44495EPSS 0.5%
- axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`grypeCVE-2026-44494EPSS 1.0%
- Axios: Header Injection via Prototype PollutiongrypeCVE-2026-42035EPSS 0.4%
- Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0grypeCVE-2026-42043EPSS 0.7%
- Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackinggrypeCVE-2026-42033EPSS 0.8%
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdaptergrypeCVE-2026-44487EPSS 0.7%
- Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectiongrypeCVE-2026-44486EPSS 0.7%
- Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectiongrypeCVE-2026-44496EPSS 0.6%
- form-data: CRLF injection in form-data via unescaped multipart field names and filenamesgrypeCVE-2026-12143EPSS 0.5%
- axios: Axios affected by Denial of Service via __proto__ Key in mergeConfigAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providi…trivyCVE-2026-25639
- axios: Axios: Arbitrary HTTP header injection via prototype pollutionAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability ex…trivyCVE-2026-42035
- axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie nameAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments…trivyCVE-2026-44496
- axios: Axios: Denial of Service due to unenforced request and response size limitsAxios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments wh…trivyCVE-2026-44488
- axios: Axios: HTTP Transport Hijacking via Prototype PollutionAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON respo…trivyCVE-2026-42033
- axios: Axios: Information disclosure due to prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transf…trivyCVE-2026-44495
- axios: Axios: Information disclosure of proxy credentials via HTTP redirectsAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorizati…trivyCVE-2026-44486
- axios: Axios: Information disclosure of proxy credentials via redirect flowsAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial …trivyCVE-2026-44487
- axios: Axios: Man-in-the-Middle (MITM) attack via Prototype PollutionAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-…trivyCVE-2026-44494
- axios: Axios: NO_PROXY bypass via crafted URLAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vu…trivyCVE-2026-42043
- axios: Axios: Prototype pollution allows information disclosure and request manipulationAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnPropert…trivyCVE-2026-42264
- form-data: form-data: Form field override via CRLF injectionform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee…trivyCVE-2026-12143
This report is public.