Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Description

No description available.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

Affected version(s): **<= 0.31.0 >= 1.0.0, < 1.15.1**
Patched version(s): **0.31.1 1.15.1**

References

Could your website be exposed too?

SmartScanner can check your website for Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams and gives you actionable findings to investigate.

Start a free scan

Related Issues

Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - CVE-2026-44496
Axios: Header Injection via Prototype Pollution - CVE-2026-42035
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - CVE-2026-40175

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated May 05, 2026