redhat/nodejs-axios vulnerabilities

Latest redhat/nodejs-axios CVEs

Newest publication first

1. CVE-2026-67312 axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON

   Published 2026-08-01

   Medium·CVSS 6.3 EPSS 0.52%

   axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled...

2. CVE-2026-67319 axios before 0.33.0 Prototype Pollution via nested option objects

   Published 2026-08-01

   Medium·CVSS 6.3 EPSS 0.32%

   axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain obj...

3. CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

   Published 2026-08-01

   High·CVSS 8.3 EPSS 0.52%

   axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.