HTTP Client Vulnerability in Axios Affects Multiple Versions by Axios

CVE-2026-101907

What is CVE-2026-101907?

The Axios HTTP client, utilized widely for both browser and Node.js applications, exhibits a critical flaw in versions ranging from 1.17.0 to 1.20.0. Specifically, when the fetch adapter is engaged with the maxRedirects parameter set to zero, it fails to adhere to the intended no-redirect policy. Instead of returning the redirect response unchanged, the underlying fetch implementation proceeds to follow the redirect. This behavior poses serious security concerns, as it enables redirected requests to access internal responses and potentially interact with state-changing internal endpoints, undermining the expected security posture of applications that rely on Axios. The issue has been resolved in version 1.20.0.

References