axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
{ "last_known_affected_version_range": "<= 1.7.3" }