Upgrade to the latest version of axios

Oct 13, 2025 by pinkandtrash.com 86 views

Introduction

In the ever-evolving landscape of open source security, vulnerabilities can arise from even the most trusted libraries. The recent detection of CVE-2025-27152 in axios-0.21.4.tgz serves as a stark reminder of the importance of vigilance in maintaining the security of our applications. In this article, we will delve into the details of this vulnerability, its impact, and the suggested fix to ensure the integrity of our open source dependencies.

CVE-2025-27152 - Medium Severity Vulnerability

axios, a promise-based HTTP client for the browser and node.js, has been found to contain a medium severity vulnerability. The issue arises when passing absolute URLs rather than protocol-relative URLs to axios. Even if the baseURL is set, axios sends the request to the specified absolute URL, potentially causing Server-Side Request Forgery (SSRF) and credential leakage. This vulnerability affects both server-side and client-side usage of axios.

Vulnerable Library Details

Vulnerable Library: axios-0.21.4.tgz
Library Home Page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz
Path to Dependency File: /package.json
Path to Vulnerable Library: /node_modules/axios/package.json

Dependency Hierarchy

The vulnerability was found in the following dependency hierarchy:

- builders-13.0.2.tgz (Root Library)
  - browser-sync-2.27.7.tgz
    - localtunnel-2.0.2.tgz
      - :x: **axios-0.21.4.tgz** (Vulnerable Library)

Found in Base Branch

The vulnerability was found in the base branch: master

Vulnerability Details

The axios vulnerability occurs when passing absolute URLs rather than protocol-relative URLs to axios. This can lead to SSRF and credential leakage, impacting both server-side and client-side usage of axios. The issue is fixed in version 1.8.2.

Publish Date: 2025-03-07
URL: https://www.mend.io/vulnerability-database/CVE-2025-27152

CVSS 3 Score Details (5.5)

The CVSS 3 score for this vulnerability is 5.5, indicating a medium severity risk.

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

The suggested fix for this vulnerability is to upgrade the version of axios to 1.8.2 or later.

Type: Upgrade version
Origin: https://github.com/advisories/GHSA-jr5f-v2jv-69x6
Release Date: 2025-03-07
Fix Resolution: 1.8.2

Conclusion

The detection of CVE-2025-27152 in axios-0.21.4.tgz serves as a reminder of the importance of maintaining the security of our open source dependencies. By staying vigilant and addressing vulnerabilities promptly, we can ensure the integrity of our applications and protect against potential threats. We recommend upgrading to the latest version of axios to mitigate this vulnerability.

Step Up Your Open Source Security Game with Mend

To learn more about how to protect your open source dependencies and stay ahead of security threats, visit Mend.
CVE-2025-27152 (Medium) Detected in axios-0.21.4.tgz: A Threat to Open Source Security - Q&A

Introduction

In our previous article, we discussed the detection of CVE-2025-27152 in axios-0.21.4.tgz, a promise-based HTTP client for the browser and node.js. This vulnerability has the potential to cause Server-Side Request Forgery (SSRF) and credential leakage, impacting both server-side and client-side usage of axios. In this Q&A article, we will address some of the most frequently asked questions about this vulnerability and provide guidance on how to mitigate it.

Q: What is CVE-2025-27152?

A: CVE-2025-27152 is a medium severity vulnerability detected in axios-0.21.4.tgz, a promise-based HTTP client for the browser and node.js. The issue arises when passing absolute URLs rather than protocol-relative URLs to axios, potentially causing SSRF and credential leakage.

Q: What is the impact of this vulnerability?

A: The impact of this vulnerability is significant, as it can lead to SSRF and credential leakage, affecting both server-side and client-side usage of axios. This can result in unauthorized access to sensitive data and potentially compromise the security of your application.

Q: How does this vulnerability occur?

A: The vulnerability occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if the baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage.

Q: What is the CVSS 3 score for this vulnerability?

A: The CVSS 3 score for this vulnerability is 5.5, indicating a medium severity risk.

Q: What is the suggested fix for this vulnerability?

A: The suggested fix for this vulnerability is to upgrade the version of axios to 1.8.2 or later.

Q: How can I verify if my application is affected by this vulnerability?

A: To verify if your application is affected by this vulnerability, you can check the version of axios being used in your application. If you are using axios-0.21.4.tgz or earlier, you are likely affected by this vulnerability.

Q: What are the best practices for mitigating this vulnerability?

A: To mitigate this vulnerability, we recommend the following best practices:

Upgrade to the latest version of axios: Upgrade to the latest version of axios (1.8.2 or later) to ensure you have the latest security patches.
Use protocol-relative URLs: Use protocol-relative URLs when making requests to avoid passing absolute URLs to axios.
Validate user input: Validate user input to prevent malicious URLs from being passed to axios.
Monitor your application for suspicious activity: Monitor your application for suspicious activity and take prompt action if you detect any signs of a security breach.

Q: What resources are available to help me mitigate this vulnerability?

A: To learn more about how to protect your open source dependencies and stay ahead of security threats, visit Mend. Our team of experts is available to provide guidance and support to help you mitigate this vulnerability and ensure the security of your application.