VulertSecurity VulertSecurity

Vulnerability Database · npm · axios · Version

axios 1.3.4

1.3.4 is affected by 37 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 1.20.0.

Critical 3 High 15 Medium 18 Low 1 Unrated 0

All axios versions & vulnerabilities → Source repository Search the database for this package →
Released 22 Feb 2023 Licence MIT Also known from other sources 32 Newer releases 145 Database updated 22/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

axios 1.3.4 vulnerabilities

37 vulnerabilities cover axios 1.3.4. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-40175: Axios Library Vulnerability Leading to Unrestricted Cloud Metadata Exfiltration 10.0 critical 1.15.0 10 Apr 2026
CVE-2025-62718: Axios NO_PROXY Hostname Normalization Bypass Leading to SSRF 9.3 critical 1.15.0 09 Apr 2026
CVE-2026-44494: axios Prototype Pollution Vulnerability Leading to Full Man-in-the-Middle Attack 8.7 high 1.16.0 29 May 2026
CVE-2026-44492: axios NO_PROXY Bypass via IPv4-Mapped IPv6 Addresses 8.6 high 1.16.0 29 May 2026
CVE-2026-44487: Axios Proxy-Authorization Credential Leak in Node.js HTTP Adapter 8.2 high 1.16.0 04 Jun 2026
SSRF and Credential Leakage Vulnerability in axios Package 7.7 high 1.8.2 07 Mar 2025
Excessive Recursion Vulnerability in Axios: Denial of Service Risk 7.5 medium No fix published 01 Aug 2026
NO_PROXY Bypass Vulnerability in Axios Package 7.5 medium No fix published 01 Aug 2026
CVE-2026-44496: Axios Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 7.5 high 1.16.0 04 Jun 2026
CVE-2026-44486: Axios Proxy-Authorization Header Leak in Node.js HTTP Adapter 7.5 high 1.16.0 04 Jun 2026
CVE-2026-42039: Axios Unbounded Recursion in toFormData Leads to DoS via Deeply Nested Request Data 7.5 medium 1.15.1 05 May 2026
CVE-2026-25639: Axios Denial of Service via __proto__ Key in mergeConfig 7.5 high 1.13.5 09 Feb 2026
CVE-2025-58754: Axios DoS Vulnerability Due to Unchecked Data URI Size 7.5 high 1.12.0 11 Sep 2025
CVE-2025-58754: Axios DoS Vulnerability Due to Lack of Data Size Check 7.5 high 1.12.0 11 Sep 2025
CVE-2026-42033: Axios Prototype Pollution Vulnerability Leading to Response Tampering and Data Exfiltration 7.4 high 1.15.1 05 May 2026
CVE-2026-42035: Axios Header Injection via Prototype Pollution 7.4 high 1.15.1 05 May 2026
CVE-2026-42264: Axios Prototype Pollution Vulnerability Leading to Credential Injection and Request Hijacking 7.4 high 1.15.2 05 May 2026
CVE-2026-42043: Axios Incomplete Fix for NO_PROXY Bypass Vulnerability 7.2 high 1.15.1 05 May 2026
CVE-2026-44495: axios Prototype Pollution Vulnerability Leading to Credential Theft and Response Hijacking 7.0 high 1.15.2 29 May 2026
CVE-2026-101904: Axios Header Injection via Inherited Headers After Minimal Interceptor 6.9 medium 1.20.0 30 Sep 2026
CVE-2026-42038: Axios No_Proxy Bypass via IP Alias Allows SSRF 6.8 medium 1.15.1 05 May 2026
CVE-2026-42044: Axios Prototype Pollution Vulnerability Leading to Invisible JSON Response Tampering 6.5 medium 1.15.2 05 May 2026
CVE-2023-45857: Axios Cross-Site Request Forgery Vulnerability 6.5 medium 1.6.0 08 Nov 2023
Prototype Pollution Vulnerability in Axios: Risk of Malicious Request Manipulation 6.3 medium 1.18.0 20 Jul 2026
CVE-2026-39865: Axios HTTP/2 Session Cleanup State Corruption Vulnerability 5.9 medium 1.13.2 08 Apr 2026
CVE-2026-42042: Axios XSRF Token Cross-Origin Leakage via Prototype Pollution 5.4 medium 1.15.1 05 May 2026
CVE-2026-42037: Axios CRLF Injection Vulnerability in Multipart Form-Data Handling 5.3 medium 1.15.1 05 May 2026
CVE-2026-42034: Axios HTTP Adapter Streamed Uploads Bypass Max Body Length 5.3 medium 1.15.1 05 May 2026
CVE-2026-42036: Axios HTTP Adapter Streamed Responses Bypass Max Content Length 5.3 medium 1.15.1 05 May 2026
CVE-2026-44490: axios DoS & Header Injection via Prototype Pollution 4.8 medium 1.16.0 29 May 2026
CVE-2026-42041: Axios Authentication Bypass via Prototype Pollution in validateStatus 4.8 medium 1.15.1 05 May 2026
Prototype Pollution Vulnerability in Axios Package: Nested Option Objects Exploitable 3.7 medium No fix published 01 Aug 2026
CVE-2026-42040: Axios Null Byte Injection Vulnerability in AxiosURLSearchParams 3.7 low 1.15.1 05 May 2026
Denial of Service Vulnerability in Axios: Deep formToJSON Key Recursion N/A medium No fix published 01 Aug 2026
Prototype Pollution Vulnerability in Axios: Risk of Altered Request Construction N/A medium No fix published 01 Aug 2026
Critical Malicious Code Vulnerability in Axios Package N/A critical No fix published 31 Mar 2026
Server-Side Request Forgery in axios N/A high 1.7.4 12 Aug 2024

Looking for another version, or everything Vulert holds for axios?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About axios 1.3.4

Is axios 1.3.4 vulnerable?

Yes. 37 vulnerabilities in the Vulert database cover axios 1.3.4: 3 critical, 15 high, 18 medium and 1 low. The upgrade Vulert recommends is 1.20.0, and each entry above names the fixed version to move to.

Which version of axios should I use instead of 1.3.4?

1.20.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 1.3.4 the latest release of axios?

No. 1.3.4 was published 22 Feb 2023, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

What does a malicious-package vulnerability mean?

It means the published package itself contained hostile code — a backdoor, a credential stealer or similar — rather than only a bug. Registries remove such packages once they are confirmed, so treat any application that resolved an affected version as compromised and rotate the credentials it could reach.

How do I monitor axios for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the axios version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.