HeroDevs Launches Never-Ending Support (NES) for Axios

Axios is the most widely used HTTP client in the JavaScript ecosystem. First released in 2014, the package averages more than 85 million weekly downloads on npm and sits in the dependency tree of more than 174,000 published packages. If your application talks to an API, there is a good chance Axios is doing the talking, often as a transitive dependency you never chose.

‍

Today, HeroDevs is announcing the availability of Never-Ending Support (NES) for Axios, and a partnership with the Axios project covering the legacy Axios 0.x line. NES for Axios delivers SLA-backed security fixes for every CVSS severity as a drop-in npm replacement with no breaking API changes. And because this is a direct partnership, a portion of the new product funds the Axios project itself.

‍

The Axios 0.x Support Gap

Axios 1.0 shipped on October 4, 2022, yet a large population of production applications still runs 0.x, pinned there by transitive dependencies, older SDKs, and codebases where the upgrade never made a sprint. Axios publishes no formal LTS schedule and no per-version maintenance windows: fixes land on the latest 1.x and 0.x releases when maintainers have the capacity to do so, and only to the newest version.

That volunteer-led backporting matters, in recent releases, including 0.34.0 (published September 13, 2026), show it is still happening. However, it is only for the latest version, and best-effort maintenance is not the same as a defined SLA-backed contractual commitment.

In 2026 alone, more security advisories and CVEs have been disclosed against Axios than all prior years combined. Every advisory now poses the same question: is my legacy 0.x minor version affected?

That is the gap NES for Axios closes: a contractual commitment for vulnerability fixes delivered under defined SLAs, across all CVSS severity levels.

‍

Why 0.x Is Still Everywhere

Teams rarely stay on Axios 0.x by choice. The common causes we see in enterprise dependency trees:

• Transitive pinning. Cloud SDKs, observability agents, and internal CLIs declare, for example, axios: ^0.27.0 and have never re-released.
• Behavioral changes at 1.0. The 1.x line changed error handling, header normalization, and module resolution in ways that break code relying on 0.x behavior.
• EOL runtimes underneath. Some applications are pinned to old Axios because the Node.js runtime beneath them is itself end-of-life. In those stacks, NES for Node.js addresses the root constraint.

‍

The March 2026 npm supply chain attack made the population visible: the attacker published malicious releases on both the 1.x and 0.x branches, a clear signal that both lines remain in heavy production use worldwide. We covered that incident in detail in our analysis of the Axios compromise.

‍

The Compliance Problem an SBOM Makes Visible

An unpatched Axios 0.x entry in a Software Bill of Materials (SBOM) is the kind of finding automated audits now surface routinely. SOC 2, PCI DSS v4.0, HIPAA, FedRAMP, DORA, NIS2, and the EU Cyber Resilience Act all expect, directly or through their risk-management provisions, that components remain actively supported and that known vulnerabilities are remediated within defined timelines.

‍

A dependency with no support commitment and no defined patch path is difficult to defend in an audit, a customer security review, or a regulatory examination. "The open source project usually backports eventually" is not an answer a compliance program can be built on.

‍

What NES for Axios Delivers

NES for Axios gives organizations running different 0.x versions, whether 0.24.x, 0.27.x, or older, a secure, supported path:

• Security patches for vulnerabilities of every CVSS severity, delivered as drop-in replacement packages with no breaking API changes.
• CVE remediation SLAs: fixes ship within contractually defined windows based on severity.
• Freedom to migrate on your own schedule, with 0.x fully supported while you plan the move to the current 1.x line.
• Compliance alignment: a named vendor, committed SLAs, and a documented patch history that satisfy scanner findings and auditor questions about unsupported dependencies.

‍

Installation is a simple registry swap, not an application refactor. From the NES for Axios documentation:

{
  "dependencies": {
    "axios": "npm:@neverendingsupport/axios@0.24.0-axios-0.24.2"
  },
  "overrides": {
    "axios": "npm:@neverendingsupport/axios@0.24.0-axios-0.24.2"
  }
}

Point .npmrc at the NES registry, run npm install, and your application code, build pipeline, and tests remain unchanged. The overrides entry also remediates Axios where it hides: in the transitive tree.

‍

A Partnership That Funds Axios, Not Just Consumes It

A core term of the HeroDevs-Axios partnership agreement is that it funds the Axios project directly. This follows the model HeroDevs has established with Node.js and the OpenJS Foundation, Vue, Bootstrap, the Drupal Association, and others: enterprises get commercial support for versions the community has moved past, and the project gets a sustainable funding stream in return.

‍

This continues HeroDevs' broader investment in open source sustainability, including serving as the inaugural partner in the OpenJS Foundation's Ecosystem Sustainability Program, joining the Open Source Pledge, and founding the Open Source Sustainability Initiative with the Commonhaus Foundation. The pattern is the same in every case: the enterprises that depend on open source should be the ones funding its future.

‍

Taking Action

If your organization runs Axios 0.x in production, directly or three levels deep in the dependency tree, the next Axios CVE will not wait for a discretionary backport. You do not have to choose between a breaking mid-sprint upgrade and a known vulnerability in production.

‍

Contact the HeroDevs team to secure your Axios applications, or visit the NES for Axios product page to see coverage details and get started.

‍

Frequently Asked Questions

Which Axios versions does NES for Axios cover?

NES for Axios covers the Axios 0.x line, including versions such as 0.24.x and 0.27.x. Coverage includes security fixes for vulnerabilities of every CVSS severity, delivered as drop-in packages under contractual SLAs.

Does Axios have an official LTS program or end-of-life dates?

No. Axios publishes no formal LTS schedule and no per-version maintenance windows. Fixes land on the latest release, and 0.x backports happen to the latest 0.x version at maintainer discretion, with no committed scope or timeline.

Will installing NES for Axios require code changes?

No. NES for Axios is a drop-in replacement installed through your existing npm workflow. You point your registry configuration at the secure NES registry, update your package.json dependency and overrides entries, and run npm install. Application code, builds, and tests remain unchanged, and the override also covers Axios pulled in transitively.

Does this partnership change how the Axios open source project is maintained?

No. Axios remains independently developed and maintained by its open source team, with active work continuing on the 1.x line. The partnership adds commercial 0.x support through HeroDevs and directs funding back to the project for continued development. HeroDevs is also a Gold sponsor of the Axios project.