← Scan another repo

github.com/axios/axios

@ a339fe124a4b

Submitted 8/5/2026, 7:37:34 PM · Status: ok

Risk grade
F
100 / 100
Findings
138
0 critical15 high122 medium1 low0 info0 on CISA KEV0ATT&CK
Showing 138 of 138 findings

Findings

  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
    grypeCVE-2026-42264EPSS 0.7%
  • Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
    grypeCVE-2026-25639EPSS 2.5%
  • Axios is vulnerable to DoS attack through lack of data size check
    grypeCVE-2025-58754EPSS 1.1%
  • axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
    grypeCVE-2025-27152EPSS 0.8%
  • axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
    grypeCVE-2026-44495EPSS 0.5%
  • axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
    grypeCVE-2026-44494EPSS 1.0%
  • Axios: Header Injection via Prototype Pollution
    grypeCVE-2026-42035EPSS 0.4%
  • Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
    grypeCVE-2026-42043EPSS 0.7%
  • Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
    grypeCVE-2026-42033EPSS 0.8%
  • Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
    grypeCVE-2026-44487EPSS 0.7%
  • Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
    grypeCVE-2026-44486EPSS 0.7%
  • Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
    grypeCVE-2026-44496EPSS 0.6%
  • vite: `server.fs.deny` bypass on Windows alternate paths
    grypeCVE-2026-53571EPSS 0.6%
  • vite: `server.fs.deny` bypass on Windows alternate paths
    Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, includin…
    trivyCVE-2026-53571

This report is public.