Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
axios Server-Side Request Forgery (SSRF) Vulnerability - CVE-2025-27152 - Vulnerability Database
axios

axios Server-Side Request Forgery (SSRF) Vulnerability - CVE-2025-27152

High
Reference: CVE-2025-27152
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-27152
Title: axios Server-Side Request Forgery (SSRF) Vulnerability
Overview:

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set axios sends the request to the specified absolute URL potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.