Security
فارسی
All products

Red Hat build of Apicurio Registry 2/axios

Red Hat · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033 · GHSA-PF86-5X62-JRWF axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043 · GHSA-PMWG-CVHR-8VH7 axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
Axios: Header Injection via Prototype PollutionCVE-2026-42035 · GHSA-6CHQ-WFR3-2HJ9 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
Axios HTTP/2 Session Cleanup State Corruption VulnerabilityCVE-2026-39865 · GHSA-QJ83-CQ47-W5F8 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijackingCVE-2026-42264 · GHSA-Q8QP-CVCW-X6JJ axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsCVE-2026-42040 · GHSA-XHJH-PMCV-23JW axiosCryostat 4/axios npmRed Hat Low Fix reported
Axios: HTTP adapter streamed responses bypass maxContentLengthCVE-2026-42036 · GHSA-VF2M-468P-8V99 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041 · GHSA-W9J2-PVGH-6H63 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
Axios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039 · GHSA-62HF-57XW-28J9 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamCVE-2026-42037 · GHSA-445Q-VR5W-6Q77 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0CVE-2026-42034 · GHSA-5C9X-8GCM-MPGX axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044 · GHSA-3W6X-2G7M-8V23 axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718 · GHSA-3P68-RC4W-QGX5 axiosGatekeeper 3/redhat-user-workloads/gatekeeper-3-18 npmRed Hat Medium Fix reported
Server-Side Request Forgery in axiosCVE-2024-39338 · GHSA-8HC4-VH64-CXMJ axiosMigration Toolkit for Runtimes/axios npmRed Hat High Fix reported
Axios Cross-Site Request Forgery VulnerabilityCVE-2023-45857 · GHSA-WF5P-G6VW-RHXX axiosCryostat 2/axios npmRed Hat Medium Fix reported