Critical SSRF Vulnerability in axios Package: Potential Credential Leakage
Summary
CVE-2025-27152: axios is a promise based HTTP client for the browser and node.js. Affects node-axios versions 0.21.1+dfsg-1 – 1.8.4+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
axios is a widely-used promise-based HTTP client for both browser and Node.js environments. It simplifies making HTTP requests and handling responses, providing features like request and response interception, automatic JSON data transformation, and support for async/await. However, axios is vulnerable to a significant issue when absolute URLs are passed instead of protocol-relative URLs, which can lead to server-side request forgery (SSRF) and potential credential leakage.
Vulnerability Detail
The vulnerability arises when users pass absolute URLs to axios, disregarding the baseURL setting. This behavior can lead to unintended requests being sent to external servers, which may expose sensitive information or allow attackers to exploit the application through SSRF attacks. The issue affects both server-side and client-side implementations of axios, making it critical for developers to address.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using absolute URLs in your axios requests. Instead, use protocol-relative URLs or ensure that any URLs passed to axios are properly validated and sanitized to prevent SSRF vulnerabilities.
Conclusion
The axios package has a critical vulnerability that can lead to SSRF and credential leakage when absolute URLs are used. It is essential for developers to update to version 1.8.2 or later to mitigate this risk. Additionally, implementing proper URL validation can serve as a temporary workaround until an update can be applied.
See every vulnerability recorded for node-axios →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, including credentials, and may allow attackers to perform actions on behalf of the application.
Yes, the vulnerability affects all versions of axios prior to 1.8.2. It is crucial to update to the latest version to mitigate the risk.
If an immediate update is not possible, ensure that you validate and sanitize all URLs passed to axios to prevent SSRF attacks.
Related vulnerabilities
Recent vulnerabilities recorded for node-axios.
