CVE-2025-27152

axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.1

Review impact separately from score.

Published · March 8, 2025

Updated · November 1, 2026

Description

A flaw was discovered in Axios. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, which can potentially lead to server-side request forgery (SSRF). This issue impacts both server-side and client-side usage of axios.

Statement

As per further reports credential leakage is not possible in this SSRF, which is why confidentiality has been marked as low and Red Hat has evaluated this vulnerability as moderate severity.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-918 · Server-Side Request Forgery