SSRF and Credential Leakage Vulnerability in axios Package
Summary
CVE-2025-27152: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL. Affects axios across 2 version ranges.
< 0.30.0
>= 1.0.0, < 1.8.2
Fixed in 0.30.0 or 1.8.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-axios · Debian:11
The same CVE-2025-27152 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It provides a simple API for handling requests and responses, supporting features like interceptors, automatic JSON data transformation, and request cancellation. However, a vulnerability has been identified that allows for Server-Side Request Forgery (SSRF) and potential credential leakage when absolute URLs are passed to axios requests, even when a base URL is set.
Vulnerability Detail
The vulnerability arises from the way axios handles absolute URLs. When an absolute URL is provided to an axios request, it bypasses the configured base URL and sends the request directly to the specified URL. This behavior can lead to SSRF attacks, where an attacker can make requests to internal services, and it can also result in credential leakage, as sensitive headers (like API keys) may be sent to unintended third-party hosts. The issue affects both server-side and client-side usage of axios, making it critical for developers to be aware of this risk.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.30.00.30.0npm install axios@0.30.0 -
>= 1.0.0, < 1.8.21.8.2npm install axios@1.8.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid passing absolute URLs to axios requests. Instead, ensure that all requests use relative paths or validate user input to prevent absolute URLs from being used. For example, modify your code as follows:
const userId = '123'; // Use a relative path instead of an absolute URL
await internalAPIClient.get(userId);
Conclusion
The axios package has a vulnerability that allows for SSRF and credential leakage when absolute URLs are used in requests. It is crucial for developers to update to version 1.8.2 or later to mitigate this risk. Additionally, implementing input validation can help prevent exploitation of this vulnerability until an update is applied.
See every vulnerability recorded for axios →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data or services.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the package-lock.json file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The impacts include unauthorized access to internal services via SSRF and the risk of exposing sensitive credentials, such as API keys, to malicious third parties.
Yes, you can implement input validation to ensure that only relative URLs are passed to axios requests, effectively mitigating the risk until an update can be applied.
If an immediate update is not possible, ensure that your application does not accept user input that can lead to absolute URLs being passed to axios, and consider implementing additional security measures to protect sensitive data.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
