PatchTheCVEaxios vulnerabilities and fixes
Recent CVEs affecting axios, with upgrade or downgrade steps. 10 tracked.
axios has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-08-01. Highest priority: CVE-2026-67317 (score 48/100).
- CVE-2026-67312 HIGH 7.5 UPGRADE axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDa
- CVE-2026-67313 HIGH 7.5 UPGRADE axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData fiel
- CVE-2026-67314 MEDIUM 6.5 UPGRADE axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handl
- CVE-2026-67315 HIGH 7.5 UPGRADE axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address i
- CVE-2026-67316 HIGH 7.4 UPGRADE axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.p
- CVE-2026-67317 HIGH 7.5 UPGRADE axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t
- CVE-2026-67318 MEDIUM 5.3 UPGRADE axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed
- CVE-2026-67319 LOW 3.7 UPGRADE axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option object
- CVE-2026-67320 HIGH 7.5 UPGRADE axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy
- CVE-2026-67321 HIGH 7.5 UPGRADE axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFor
FAQ
How do I fix axios vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is axios being exploited right now?
None of the tracked axios CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which axios CVE should I patch first?
CVE-2026-67317 currently ranks highest (48/100): axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t.