Package impact
npm / axios
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2026-42039 | high | 7.5 | 7.5 | 1mo ago | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data | |
| CVE-2026-42038 | high | 7.5 | 7.5 | 1mo ago | Axios: no_proxy bypass via IP alias allows SSRF | |
| CVE-2026-25639 | high | 7.5 | 7.5 | 4mo ago | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig | |
| CVE-2026-42035 | high | 7.4 | 7.4 | 1mo ago | Axios: Header Injection via Prototype Pollution | |
| CVE-2026-42033 | high | 7.4 | 7.4 | 1mo ago | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking | |
| CVE-2026-42040 | low | 3.7 | 3.7 | 1mo ago | Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams |