CVE-2020-28168: Server-Side Request Forgery in Axios NPM Package
Summary
CVE-2020-28168: Axios vulnerable to Server-Side Request Forgery. Affects axios versions < 0.21.1. Fixed in 0.21.1. How to fix ↓
Also tracked for
- node-axios · Debian:11
The same CVE-2020-28168 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular NPM package used for making HTTP requests from JavaScript applications. It provides an easy-to-use API and supports various features such as request and response interception, automatic JSON parsing, and more. However, version 0.21.0 of Axios is vulnerable to a Server-Side Request Forgery (SSRF) attack. This vulnerability allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Vulnerability Detail
The SSRF vulnerability in Axios arises from improper handling of redirects. By exploiting this vulnerability, an attacker can trick the application into making requests to internal or restricted resources that should not be accessible. This can lead to unauthorized access, data leakage, or further exploitation of internal systems. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.21.1
This is the first release that contains the fix.
npm install axios@0.21.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate update to the latest version is not possible, a temporary workaround is to implement server-side input validation and sanitization. This can help prevent malicious URLs from being processed and mitigate the risk of SSRF attacks. Here's an example of how to validate and sanitize user-provided URLs in Node.js:
const { URL } = require('url');
function validateAndSanitizeUrl(userUrl) {
try {
const url = new URL(userUrl);
// Perform additional validation or restriction checks if required
return url.toString();
} catch (error) {
// Handle invalid URLs
return null;
}
}
By validating and sanitizing URLs before making requests, the application can ensure that only trusted and intended destinations are accessed.
Conclusion
The SSRF vulnerability in Axios NPM package version 0.21.0 can be mitigated by updating to version 0.21.1 or later. It is important to promptly address this vulnerability to prevent unauthorized access and potential data leakage. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for axios →
FAQ
Axios is an NPM package used for making HTTP requests from JavaScript applications. It provides a simple and intuitive API for performing various types of requests and handling responses.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal or restricted resources from a targeted server. By exploiting SSRF, an attacker can bypass security controls and potentially access sensitive information or perform further attacks.
The SSRF vulnerability in Axios can lead to unauthorized access to internal resources, data leakage, or further exploitation of internal systems. It poses a moderate risk to applications that use the vulnerable version of Axios.
To fix this vulnerability, update your Axios dependency to version 0.21.1 or later. This version includes a fix for the SSRF vulnerability.
If immediate update is not possible, you can implement server-side input validation and sanitization to mitigate the risk of SSRF attacks. Ensure that only trusted and intended URLs are processed.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
