Fluid Attacks Database

Description

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	axios	>=1.0.0 <1.8.2 \|\| >=0 <0.30.0	1.8.2, 0.30.0
debian 12	node-axios	=1.11.0+dfsg-1 \|\| =1.12.1+dfsg-1 \|\| =1.13.1+dfsg-1 \|\| =1.13.2+dfsg-1 \|\| =1.14.0+dfsg-1 \|\| =1.15.0-1 \|\| =1.15.2-1 \|\| =1.16.0-1 \|\| =1.18.0-1 \|\| =1.19.0-1 \|\| =1.2.1+dfsg-1 \|\| =1.2.1+dfsg-1+deb12u1 \|\| =1.20.0-1 \|\| =1.5.1+dfsg-1 \|\| =1.6.2+dfsg-1 \|\| =1.6.8+dfsg-1 \|\| =1.6.8+dfsg-2 \|\| =1.7.3+dfsg-1 \|\| =1.7.4+dfsg-1 \|\| =1.7.7+dfsg-1 \|\| =1.7.9+dfsg-1 \|\| =1.8.4+dfsg-1	-
debian 13	node-axios	>=0 <1.8.4+dfsg-1	1.8.4+dfsg-1
debian 14	node-axios	>=0 <1.8.4+dfsg-1	1.8.4+dfsg-1
rpm rhel8	grafana	-	-
rpm rhel9	grafana	-	-

Aliases

1. CVE-2025-271522. NVD-2025-271523. OSV-2025-271524. OSV-DEBIAN-2025-271525. GHSA-jr5f-v2jv-69x66. GCVE-2025-271527. SECURITY-TRACKER-CVE-2025-27152

References

1. https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x62. https://github.com/axios/axios/issues/64633. https://github.com/axios/axios/pull/68294. https://github.com/axios/axios/commit/02c3c69ced0f8fd86407c23203835892313d7fde5. https://github.com/axios/axios/commit/fb8eec214ce7744b5ca787f2c3b8339b2f54b00f6. https://github.com/axios/axios/releases/tag/v1.8.27. https://github.com/andreglock/axios-ssrf

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.