CVE-2025-27152

Publication date 7 March 2025

Last updated 12 March 2025

Ubuntu priority

Medium

Why this priority?

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ?baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

Read the notes from the security team

Status

Package Ubuntu Release Status
node-axios 24.10 oracular
Needs evaluation
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation

Notes

rodrigo-zaiden

similar to CVE-2024-39338