CVE-2024-57965 Other in axios
Potential origin verification bypass in axios HTTP client due to improper URL parsing, though disputed as a real vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57965?
CVE-2024-57965 is a vulnerability in axios, published on 29 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
Weakness: CWE-346
Which versions are affected by CVE-2024-57965?
It affects 1 product.
Products include Axios Axios.
How do I fix CVE-2024-57965?
Upgrade to a fixed version.
Is CVE-2024-57965 being exploited?
There is no known exploitation of CVE-2024-57965 in the wild and no public exploit code.
Other vulnerabilities in axios
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2025-27152 Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Sources
Also known as DEBIAN-CVE-2024-57965, GHSA-fh7x-2848-jmpf, UBUNTU-CVE-2024-57965.