A
Vendor security profile
axios
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs39
Critical0
CISA KEV0
Public exploit38
Patch rate%15
Avg. CVSS7.1
12-month vulnerability rate
0
0
0
1
0
8
1
7
0
10
12
0
CVE KEV
CVE severity distribution
39toplam CVE
High19 (49%)
Medium20 (51%)
Patch and exploitation view
%15
Verified patch
%0
CISA KEV
%97
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
33Unknown
Latest vulnerabilities
8.3
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
A
Patch status unknownEPSS %0
6.9
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
A
Patch status unknownEPSS %0
7.0
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
A
Patch status unknownEPSS %0
8.2
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
A
Patch status unknownEPSS %0
7.6
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
A
Patch status unknownEPSS %0
6.9
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
A
Patch status unknownEPSS %0
8.2
CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
A
Patch status unknownEPSS %0
6.9
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
A
Patch status unknownEPSS %0
8.2
CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
A
Patch status unknownEPSS %0
6.9
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
A
Patch status unknownEPSS %1