Upgrading to the latest version of Axios

Oct 13, 2025 by pinkandtrash.com 37 views

axios-0.21.4.tgz: 3 Vulnerabilities (Highest Severity is: 7.5)

Axios is a popular promise-based HTTP client for the browser and Node.js. It provides a simple and intuitive way to make HTTP requests, making it a widely-used library in the JavaScript ecosystem. However, like any other library, Axios is not immune to vulnerabilities. In this article, we will discuss three vulnerabilities found in Axios version 0.21.4.tgz, including their severity, impact, and suggested fixes.

WS-2023-0439

CVE	Severity	CVSS	Dependency	Type	Fixed in (axios version)	Remediation Possible
WS-2023-0439	High	7.5	axios-0.21.4.tgz	Direct	1.6.3	❌

Vulnerability Details

Axios is vulnerable to Regular Expression Denial of Service (ReDoS). When a manipulated string is provided as input to the format method, the regular expression exhibits a time complexity of O(n^2). Server becomes unable to provide normal service due to the excessive cost and time wasted in processing vulnerable regular expressions.

CVSS 3 Score Details

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

Suggested Fix

Type: Upgrade version Origin: https://www.mend.io/vulnerability-database/WS-2023-0439 Release Date: 2023-10-25 Fix Resolution: 1.6.3

CVE-2025-27152

CVE	Severity	CVSS	Dependency	Type	Fixed in (axios version)	Remediation Possible
CVE-2025-27152	High	7.5	axios-0.21.4.tgz	Direct	1.8.2	❌

Vulnerability Details

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

CVSS 3 Score Details

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

Suggested Fix

Type: Upgrade version Origin: https://github.com/advisories/GHSA-jr5f-v2jv-69x6 Release Date: 2025-03-07 Fix Resolution: 1.8.2

CVE-2023-45857

CVE	Severity	CVSS	Dependency	Type	Fixed in (axios version)	Remediation Possible
CVE-2023-45857	Medium	6.5	axios-0.21.4.tgz	Direct	0.28.0	❌

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

CVSS 3 Score Details

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

Suggested Fix

Type: Upgrade version Release Date: 2023-11-08 Fix Resolution: 0.28.0

In conclusion, Axios version 0.21.4.tgz has three vulnerabilities, including Regular Expression Denial of Service (ReDoS), Server-Side Request Forgery (SSRF), and credential leakage. These vulnerabilities have a high severity and can have a significant impact on the security of your application. To mitigate these vulnerabilities, we recommend upgrading to the latest version of Axios, which is 1.8.2 for CVE-2025-27152 and 0.28.0 for CVE-2023-45857. Additionally, we recommend following best practices for secure coding and testing to ensure the security of your application.

Q: What are the three vulnerabilities found in Axios version 0.21.4.tgz?

A: The three vulnerabilities found in Axios version 0.21.4.tgz are:

Regular Expression Denial of Service (ReDoS): This vulnerability occurs when a manipulated string is provided as input to the format method, causing the regular expression to exhibit a time complexity of O(n^2).
Server-Side Request Forgery (SSRF): This vulnerability occurs when passing absolute URLs rather than protocol-relative URLs to axios, potentially causing SSRF and credential leakage.
Credential Leakage: This vulnerability occurs when the confidential XSRF-TOKEN stored in cookies is inadvertently revealed by including it in the HTTP header X-XSRF-TOKEN for every request made to any host.

Q: What is the severity of these vulnerabilities?

A: The severity of these vulnerabilities is:

High: Regular Expression Denial of Service (ReDoS) and Server-Side Request Forgery (SSRF) have a high severity, as they can cause significant impact on the security of your application.
Medium: Credential Leakage has a medium severity, as it can cause confidentiality impact.

Q: How can I mitigate these vulnerabilities?

A: To mitigate these vulnerabilities, we recommend:

Upgrading to the latest version of Axios: Upgrade to the latest version of Axios, which is 1.8.2 for CVE-2025-27152 and 0.28.0 for CVE-2023-45857.
Following best practices for secure coding and testing: Follow best practices for secure coding and testing to ensure the security of your application.
Using a comprehensive platform for identifying, prioritizing, and remediating open-source vulnerabilities: Use a comprehensive platform like Mend to identify, prioritize, and remediate open-source vulnerabilities.

Q: What is the CVSS 3 score for these vulnerabilities?

A: The CVSS 3 score for these vulnerabilities is:

7.5: Regular Expression Denial of Service (ReDoS) and Server-Side Request Forgery (SSRF) have a CVSS 3 score of 7.5.
6.5: Credential Leakage has a CVSS 3 score of 6.5.

Q: What is the impact of these vulnerabilities?

A: The impact of these vulnerabilities is:

Confidentiality Impact: Regular Expression Denial of Service (ReDoS) and Server-Side Request Forgery (SSRF) can cause confidentiality impact.
Availability Impact: Regular Expression Denial of Service (ReDoS) can cause availability impact.
Integrity Impact: None of the vulnerabilities have integrity impact.

Q: How can I stay ahead of the game and ensure the security of my application?

A: To stay ahead of the game and ensure the security of your application, we recommend:

Using a comprehensive platform for identifying, prioritizing, and remediating open-source vulnerabilities: Use a comprehensive platform like Mend to identify, prioritize, and remediate open-source vulnerabilities.
Following best practices for secure coding and testing: Follow best practices for secure coding and testing to ensure the security of your application.
Staying up-to-date with the latest security patches and updates: Stay up-to-date with the latest security patches and updates to ensure the security of your application.