Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks

Axios maintainers disclosed multiple high-severity vulnerabilities that can bypass proxy, DNS, and NO_PROXY protections—most critically an HTTP/2 adapter issue that ignores top-level Axios settings and can enable server-side request forgery (SSRF) to internal hosts and cloud metadata endpoints. The advisory lists several CVEs (e.g., HTTP/2 bypass, prototype pollution, ReDoS, fetch redirect handling) affecting multiple Axios versions (notably 1.13.0–1.20.0) and urges immediate inventory and mitigation for server-side Node.js apps that make outbound requests or accept user-supplied URLs.