CVE-2025-27152

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27152
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/axios/axios/issues/6463 Broken Link
https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 Exploit Vendor Advisory
https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
History

22 Sep 2025, 18:52

Type Values Removed Values Added
Summary
  • (es) axios es un cliente HTTP basado en promesas para el navegador y node.js. El problema ocurre cuando se pasan URL absolutas en lugar de URL relativas al protocolo a axios. Incluso si se configura ?baseURL, axios envía la solicitud a la URL absoluta especificada, lo que puede provocar una fuga de credenciales y SSRF. Este problema afecta tanto al uso del lado del servidor como del lado del cliente de axios. Este problema se solucionó en 1.8.2.
CPE cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Axios
Axios axios
References () https://github.com/axios/axios/issues/6463 - () https://github.com/axios/axios/issues/6463 - Broken Link
References () https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 - () https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 - Exploit, Vendor Advisory

07 Mar 2025, 20:15

Type Values Removed Values Added
References () https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 - () https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 -

07 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-07 16:15

Updated : 2025-09-22 18:52

NVD link : CVE-2025-27152

Mitre link : CVE-2025-27152

CVE.ORG link : CVE-2025-27152

JSON object : View

Products Affected

axios

  • axios
CWE
CWE-918

Server-Side Request Forgery (SSRF)