Description
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **< 0.30.0 >= 1.0.0, < 1.8.2** Patched version(s): **0.30.0 1.8.2**
References
Could your website be exposed too?
SmartScanner can check your website for axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL and gives you actionable findings to investigate.
Start a free scanRelated Issues
- webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior - CVE-2025-68458
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding - CVE-2025-11362
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
You might also like:
See something that needs correcting? Let us knowUpdated November 27, 2025