~ / search / GHSA-8hc4-vh64-cxmj

GHSA-8hc4-vh64-cxmj

Server-Side Request Forgery in axios

Source: GitHub Advisory Database (reviewed) High CVE-2024-39338

Packages

EcosystemPackageAffectedFixed in
npm axios >= 1.3.2, < 1.7.4 1.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

References

External links from the advisory. They lead to third-party sites.