CVE-2026-101907: Axios Redirect Bypass Vulnerability Leading to SSRF
Summary
CVE-2026-101907: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF. Affects axios versions >= 1.17.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It provides a simple API for sending asynchronous requests and handling responses, making it a go-to choice for developers. The library includes various features such as interceptors, automatic JSON data transformation, and support for request cancellation. However, a vulnerability has been identified in Axios versions 1.17.0 to 1.19.9, specifically in the fetch adapter, which does not enforce the maxRedirects option, potentially leading to Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability arises from the fetch adapter's failure to respect the maxRedirects configuration option. When maxRedirects is set to 0, it is intended to prevent any redirects, serving as a guard against SSRF attacks. However, the fetch adapter does not read this option and defaults to following redirects, allowing an attacker to exploit this behavior. This can lead to the application unintentionally accessing internal services or endpoints that should be protected, resulting in potential data exposure or unauthorized state changes.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update Axios, you can implement a workaround by explicitly setting the fetchOptions.redirect to 'manual' in your requests. Here is an example of how to do this:
const response = await axios.get(url, {
adapter: 'fetch',
maxRedirects: 0,
fetchOptions: { redirect: 'manual' }
});
Conclusion
The Axios vulnerability CVE-2026-101907 presents a significant risk due to its potential for SSRF attacks. By not enforcing the maxRedirects option in the fetch adapter, applications may inadvertently expose sensitive internal endpoints. It is crucial to update to the patched version or implement the recommended workaround to safeguard against this vulnerability.
See every vulnerability recorded for axios →
FAQ
The CVSS score of this vulnerability is 7.0, indicating a high severity level.
Axios versions from 1.17.0 to 1.19.9 are affected by this vulnerability.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to data exposure or unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updating is not possible, implement the workaround by setting fetchOptions.redirect to 'manual' in your requests to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
