CVE-2025-27152

Publication date 7 March 2025

Last updated 4 June 2025

Ubuntu priority

Description

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
node-axios	25.10 questing	Needs evaluation
	25.04 plucky	Needs evaluation
	24.10 oracular	Ignored end of life, was needs-triage
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation

How can I get the fixes?
What do statuses mean?

Notes

rodrigo-zaiden

similar to CVE-2024-39338

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2025-27152
https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6
https://github.com/axios/axios/issues/6463