Is axios healthy, maintained, and safe?
Maintained, but watch it. axios has real signals (drift, thin maintenance, or advisories) worth tracking.
The verdict
axios earns a health score of 40/100, a medium risk rating, computed deterministically from live npm release history, maintainer data, and the OSV vulnerability database. Maintained, but watch it. axios has real signals (drift, thin maintenance, or advisories) worth tracking.
Its most recent release shipped on 16 September 2026, 40 days ago, so development is clearly active. Across 147 releases the cadence has been steady, which is a good sign of an ongoing maintenance rhythm. Ownership rests on a single maintainer, a bus-factor of one, meaning one person's availability is a single point of failure for everyone downstream.
OSV lists 56 known advisories for axios, including 25 high. Review whether your version is in the affected range and whether a fixed release is available before depending on it. Each advisory is listed with its OSV/GHSA identifier below.
axios is usable but carries real signals, so pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package. Real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own package.json through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail: deterministic, auditable
Known vulnerabilities (56)
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Axios: Excessive recursion in formDataToJSON can cause denial of service
Denial of Service in axios
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Axios is vulnerable to DoS attack through lack of data size check
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Axios vulnerable to Server-Side Request Forgery
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Axios: Header Injection via Prototype Pollution
Allocation of Resources Without Limits or Throttling in Axios
Axios: Nested axios option objects can consume polluted prototype values
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Server-Side Request Forgery in axios
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
axios Inefficient Regular Expression Complexity vulnerability
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Axios form serializer maxDepth bypass via {} metatoken
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Axios: Header Injection via Inherited headers After Minimal Interceptor
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
Axios: no_proxy bypass via IP alias allows SSRF
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Axios: Prototype pollution gadgets can alter axios request construction
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Axios: HTTP adapter streamed responses bypass maxContentLength
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Axios Cross-Site Request Forgery Vulnerability
Axios: Prototype Pollution Gadget in axios toFormData Options
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Axios: Prototype pollution auth subfields can inject Basic auth
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Malicious code in axios (npm)
Key facts
- Latest version
- v1.20.0
- Last release
- 16 September 2026 (40 days ago)
- Total releases
- 147
- First release
- 29 August 2014
- Package age
- 12.2 years
- Maintainers
- 1
- Known advisories
- 56
- Confidence
- High
Frequently asked
Is axios still maintained?
Yes. axios released as recently as 16 September 2026 (40 days ago), so it is actively maintained.
Does axios have known security vulnerabilities?
Yes. OSV lists 56 advisories for axios. See the advisory list on this page for the OSV/GHSA identifiers.
Is axios safe to use?
Maintained, but watch it. axios has real signals (drift, thin maintenance, or advisories) worth tracking. OSPulse rates it 40/100 (medium risk) based on release recency, cadence, maintainer bus factor and known vulnerabilities.
Other npm packages we've checked
axios is one package. What about the other hundreds in your tree?
Paste your own package.json into the free health check for an instant snapshot, or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the npm registry & OSV.dev · snapshot generated 2026-10-26 · scores are deterministic and recomputed on each refresh.