Server-Side Request Forgery in axios · CVE-2024-39338 · GitHub Advisory Database · GitHub

Server-Side Request Forgery in axios

High severity GitHub Reviewed Published Aug 12, 2024 to the GitHub Advisory Database • Updated Aug 13, 2024

Package

axios (npm)

Affected versions

>= 1.3.2, <= 1.7.3

Patched versions

1.7.4

Description

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

References

Published by the National Vulnerability Database

Aug 12, 2024

Published to the GitHub Advisory Database Aug 12, 2024

Reviewed Aug 12, 2024

Last updated Aug 13, 2024