CVE-2020-28168 Axios vulnerable to Server-Side Request Forgery

What is CVE-2020-28168?

CVE-2020-28168 is a medium-severity server-side request forgery vulnerability in n/a, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Weakness: CWE-918

Which versions are affected by CVE-2020-28168?

2 open source packages ship an affected version, including axios. It affects 2 products.

Products include Axios Axios, Siemens Sinec Ins.

How do I fix CVE-2020-28168?

Upgrade axios to 0.21.1 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2020-28168 being exploited?

There is no known exploitation of CVE-2020-28168 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` High 8.7
• CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) High 8.6
• CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter High 8.3
• CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter High 8.2
• CVE-2025-27152 Possible SSRF and Credential Leakage via Absolute URL in axios Requests High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-28168, GHSA-4w2v-q235-vp99, ROOT-APP-NPM-CVE-2020-28168, UBUNTU-CVE-2020-28168.