axios product

Several products

← All axios products

No Several products CVE is in the CISA KEV catalogue.

Tracked since 10 Feb · latest article Thu 1 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 all time
High exploit odds · current: 1; high · not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

CSV download

No Several products CVE is in the CISA KEV catalogue.

Coverage

4 articles · all timeFull timeline →

4 articles from 2 outlets since 10 Feb; the latest 25 days ago.

Article
First report
Official notice

Show as table

Several products: articles
Published (UTC)	Outlet	Headline
Thu 1 Oct · 04:38 UTC	SecurityOnline	Axios Fixes Ten Flaws Affecting Millions of Node.js Applications
Thu 4 Jun · 02:07 UTC	SecurityOnline	Axios Flaws Let Attackers Hijack Traffic, Steal Credentials
Thu 14 May · 15:11 UTC	CISA	Siemens gWAP hit by RCE flaw via Axios library, patch now advised
Tue 10 Feb · 04:15 UTC	SecurityOnline	HTTP Down: High-Severity Axios Flaw (CVSS 7.5) Crashes Node.js Servers

Who reported 2 outlets, last 12 months

SecurityOnline3
CISA1

See the full timeline

1 OctAxios Fixes Ten Flaws Affecting Millions of Node.js ApplicationsSecurityOnline
4 JunAxios Flaws Let Attackers Hijack Traffic, Steal CredentialsSecurityOnline
14 MaySiemens gWAP hit by RCE flaw via Axios library, patch now advisedCISA · official notice
10 FebHTTP Down: High-Severity Axios Flaw (CVSS 7.5) Crashes Node.js ServersSecurityOnline

All CVEs in coverage

CVE-2026-44492Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)CVSS8.6High–Not in KEV13%EPSS1article

CVE-2026-25639Axios affected by Denial of Service via __proto__ Key in mergeConfigCVSSUnrated–Not in KEV2.8%EPSS1article

CVE-2026-40175axios vulnerabilityCVSS4.8Medium–Not in KEV1.9%EPSS1article

CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVSS8.7High–Not in KEV1.0%EPSS1article

CVE-2026-101901Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session InitializationCVSS8.2High–Not in KEV0.5%EPSS1article

CVE-2026-101909Axios: Prototype Pollution Gadget in axios toFormData OptionsCVSS8.3High–Not in KEV0.5%EPSS1article

CVE-2026-101906Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect LocationCVSS8.2High–Not in KEV0.5%EPSS1article

CVE-2026-101903Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)CVSS8.2High–Not in KEV0.4%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

Several products

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts