Description
Axios exposes maxRedirects to limit redirect following, and maxRedirects: 0 is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API redirect mode, so the runtime default of redirect: 'follow' applies.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.17.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - CVE-2026-67317
- Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - CVE-2026-42034
- Axios: Prototype pollution gadget in fetch adapter can alter outbound requests - CVE-2026-101908
- Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders - CVE-2026-101900
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026