Overview
Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.
A vulnerability (CVE-2025-27152) has been identified in Axios's handling of absolute URLs. Axios supports the baseURL setting to provide a base address for relative request URLs. However, when an absolute URL is supplied, Axios uses that address instead of the configured baseURL. If an application accepts attacker-controlled request paths without sufficient validation, an attacker can direct requests to internal services or attacker-controlled domains, potentially exposing API keys or other credentials included in the request headers.
This kind of unintended server-side request routing maps to CWE-918 (Server-Side Request Forgery), where an attacker can influence an application to send requests to an unintended destination. In Axios, attacker-supplied absolute URLs can override the configured baseURL, allowing requests to reach hosts outside the application's intended destination. In server-side applications, this could enable access to internal network services. Requests sent to attacker-controlled hosts may also disclose sensitive credentials configured on the Axios instance.
Details
Module Info
Product: Axios
Affected packages: axios
Affected versions:
- <=1.7.9
- <=0.29.0
GitHub repository: https://github.com/axios/axios
Published packages: https://www.npmjs.com/package/axios
Package manager: npm
- Fixed in:
- OSS Axios v1.8.2
- OSS Axios v0.30.0
- NES for Axios
Vulnerability Info
This high-severity vulnerability affects applications using Axios with a configured baseURL and insufficient validation of attacker-controlled request paths. Axios uses baseURL to resolve relative URLs, but an absolute URL overrides that setting. Consequently, an attacker-supplied absolute URL can direct requests to an unintended host. The security advisory rates this vulnerability as high severity, with a CVSS v4.0 score of 7.7.
When an attacker can influence the URL passed to Axios, they can direct requests to internal network services or attacker-controlled domains. Sensitive API keys or other credentials configured in request headers may accompany these requests, potentially exposing them to the destination host. The issue affects both server-side and client-side usage, with server-side applications additionally exposed to requests targeting internal services reachable from the server.
This behavior aligns with CWE-918 (Server-Side Request Forgery), where insufficient validation of attacker-influenced URLs allows a server to send requests to unintended destinations. In affected Axios applications, relying on baseURL to restrict request destinations can enable SSRF and credential leakage when untrusted absolute URLs are accepted.
Mitigation
Users of affected Axios packages should apply one of the following mitigations:
- Upgrade to a patched version of the axios package.
- Leverage commercial support — HeroDevs provides security support for Axios.
