StackPrism

npm package

axios vulnerabilities by version

The latest release, 1.20.0 (Aug 26, 2026), has no known vulnerabilities. 62% of last week’s 119.1M downloads went to versions with known vulnerabilities. OSV.dev lists 56 advisories for axios; the newest was published on Sep 30, 2026.

npm (opens in a new tab) describes it as “Promise based HTTP client for the browser and node.js”

Latest release
1.20.0
Aug 26, 2026, no known vulnerabilities
Downloads last week
119.1M
All versions, from npm
Advisories on OSV.dev
56
Newest Sep 30, 2026
Licence
MIT
OpenSSF Scorecard
7.7/10
axios/axios (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
1.20.0latestAug 26, 2026No known vulnerabilities44.2M
1.18.1Jun 22, 202612 known vulnerabilities, worst rated critical10.5M
1.19.0Jul 29, 202612 known vulnerabilities, worst rated critical6.1M
0.21.4Sep 6, 202123 known vulnerabilities, worst rated critical4.6M
1.18.0Jun 14, 202612 known vulnerabilities, worst rated critical4.4M
1.13.2Nov 4, 202535 known vulnerabilities, worst rated critical4M
1.16.1May 13, 202621 known vulnerabilities, worst rated critical3.8M
1.16.0May 2, 202620 known vulnerabilities, worst rated critical3.1M

Who is still on a vulnerable axios

62% of last week’s 119.1M axios downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. axios doesn’t publish support dates we can check.

LineNewest releaseReleased
11.20.0Aug 26, 2026
0.340.34.0Sep 16, 2026
0.330.33.0Jun 14, 2026
0.320.32.0May 4, 2026
0.310.31.1Apr 19, 2026
0.300.30.3Feb 18, 2026

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-101904 on OSV.dev (opens in a new tab)GHSA-j8rh-479h-cp32

    Axios: Header Injection via Inherited headers After Minimal Interceptor

    Affects >= 1.0.0, < 1.20.0. Published Sep 30, 2026.

  2. WarningCVE-2026-101900 on OSV.dev (opens in a new tab)GHSA-4hqw-qxg8-jxx2

    Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

    Affects >= 1.12.0, < 1.20.0. Published Sep 30, 2026.

  3. CriticalCVE-2026-101905 on OSV.dev (opens in a new tab)GHSA-m8m8-qj5v-23w3

    Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

    Affects >= 1.15.2, < 1.20.0. Published Sep 30, 2026.

  4. WarningCVE-2026-101899 on OSV.dev (opens in a new tab)GHSA-44g4-m2mj-wpvx

    Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

    Affects >= 1.15.0, < 1.20.0. Published Sep 30, 2026.

  5. CriticalCVE-2026-101907 on OSV.dev (opens in a new tab)GHSA-r4gj-5m52-g5wh

    Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

    Affects >= 1.17.0, < 1.20.0. Published Sep 30, 2026.

All 56 advisories are on OSV.dev (opens in a new tab).

Which axios do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for axios, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.