CVE-2025-27152 Possible SSRF and Credential Leakage via Absolute URL in axios Requests
Attackers can trigger Server-Side Request Forgery and leak credentials by passing absolute URLs to the axios HTTP client library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27152?
CVE-2025-27152 is a high-severity server-side request forgery vulnerability in axios, published on 7 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
Weakness: CWE-918
Which versions are affected by CVE-2025-27152?
4 open source packages ship an affected version, including axios. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
axios npm | All versions | 0.30.0 |
axios npm | All versions | 0.30.0 |
axios npm | From 1.0.0 | 1.8.2 |
axios npm | From 1.0.0 | 1.8.2 |
Linux distribution packages (2)
pgadmin4 SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 8.5-150600.3.9.1 |
pgadmin4 openSUSE:Leap 15.6 | All versions | 8.5-150600.3.9.1 |
Products include Axios Axios.
How do I fix CVE-2025-27152?
Upgrade axios to a fixed version for your release line: 0.30.0 or 1.8.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-27152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27152 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in axios
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
- CVE-2026-44492 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
- CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Sources
Also known as DEBIAN-CVE-2025-27152, ECHO-c986-b553-eb7a, GHSA-jr5f-v2jv-69x6, MINI-7jc4-32fg-h2xr, MINI-c73m-45h9-xgcj, ROOT-APP-NPM-CVE-2025-27152 and 2 more.