← Vulnerability feed

Vulnerability record · CVE-2024-57965 · published 29 January 2025

CVE-2024-57965: Axios origin validation error vulnerability

Axios · Axios

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.

9.8 CVSS 3.1 Critical EPSS 0.38% · top 70.3% CWE-346 · Origin validation error
9.8CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db Patch
https://github.com/axios/axios/issues/6351 Issue Tracking
https://github.com/axios/axios/pull/6714 Issue TrackingPatch
https://github.com/axios/axios/releases/tag/v1.7.8 Release Notes

Track CVE-2024-57965 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-42043Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axio…EPSS 0.58%9.1CVE-2026-42264Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL…EPSS 0.97%9.1CVE-2026-42044Axios mass assignment vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollutio…EPSS 0.86%8.7CVE-2026-44494Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Polluti…EPSS 0.93%8.6CVE-2026-44492Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. Wh…EPSS 0.78%8.3CVE-2026-67320Axios information exposure vulnerabilityaxios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configurat…EPSS 0.52%8.2CVE-2026-44490Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets…EPSS 0.40%8.2CVE-2026-44487Axios vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Author…EPSS 0.76%

Source: NIST National Vulnerability Database (record CVE-2024-57965), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.