npm - OSV

MAL-2026-14029

npm/axios-fast

Malicious code in axios-fast (npm) 14 Aug

No fix available

MAL-2026-11030

npm/vitest-axios

Malicious code in vitest-axios (npm) 23 Jul

No fix available

GHSA-gcfj-64vw-6mp9

npm/axios

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning 20 Jul

Fix available
Severity - 8.3 (High)

GHSA-hcpx-6fm6-wx23

npm/axios

Axios form serializer maxDepth bypass via {} metatoken 20 Jul

Fix available
Severity - 6.9 (Medium)

GHSA-7q8q-rj6j-mhjq

npm/axios

Axios: Nested axios option objects can consume polluted prototype values 20 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-mwf2-3pr3-8698

npm/axios

Axios: HTTP/2 streamed uploads bypass `maxBodyLength` 20 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-jqh4-m9w3-8hp9

npm/axios

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` 20 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-mmx7-hfxf-jppx

npm/axios

Axios: Prototype pollution gadgets can alter axios request construction 20 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-f4gw-2p7v-4548

npm/axios

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios 20 Jul

Fix available
Severity - 6.9 (Medium)

GHSA-42h9-826w-cgv3

npm/axios

Axios: Excessive recursion in formDataToJSON can cause denial of service 20 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-xj6q-8x83-jv6g

npm/axios

Axios: Prototype pollution auth subfields can inject Basic auth 20 Jul

Fix available
Severity - 6.3 (Medium)

GHSA-pmv8-rq9r-6j72

npm/axios

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service 20 Jul

Fix available
Severity - 6.3 (Medium)

MAL-2026-10852

npm/@gocortexio/npmgremlinbox-typosquat-axios

Malicious code in @gocortexio/npmgremlinbox-typosquat-axios (npm) 20 Jul

No fix available

MAL-2026-10772

npm/axios-native

Malicious code in axios-native (npm) 17 Jul

No fix available

MAL-2026-10773

npm/telemetry-axios

Malicious code in telemetry-axios (npm) 17 Jul

No fix available

MAL-2026-10727

npm/axios-test-one

Malicious code in axios-test-one (npm) 16 Jul

No fix available

Vulnerabilities