In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
EPSS Score
0.003
Published
2025-01-29
axios is vulnerable to Inefficient Regular Expression Complexity
CVSS Score
7.5
EPSS Score
0.079
Published
2021-08-31
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
CVSS Score
7.5
EPSS Score
0.06
Published
2019-05-07
Page 3