Vulnerabilities - Mintlify Doc Writer for Python, JavaScript, TypeScript, C++, PHP, Java, C#, Ruby & more - Visual Studio Code

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/07/21

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

Hide triaged

CVSS Score

CVE Identifier

Summary

Tags

critical

10.0

CVE-2026-42043

Axios is vulnerable to a NO_PROXY protection bypass via RFC 1122 loopback subnet (127.0.0.0/8) due to an incomplete fix for CVE-2025-62718.

Exploits Exist

Fix Available

high

8.6

CVE-2026-44492

Axios does not properly normalize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass.

Exploits Exist

Fix Available

high

8.2

CVE-2026-44487

Axios's Node.js HTTP adapter may leak Proxy-Authorization credentials to the origin server during specific proxy-to-direct redirect flows.

Exploits Exist

Fix Available

high

7.7

CVE-2025-27152

axios is vulnerable to Server-Side Request Forgery (SSRF) and credential leakage when passing absolute URLs.

Exploits Exist

Fix Available

high

7.5

CVE-2026-25639

Axios is vulnerable to denial of service via a TypeError when processing configuration objects containing __proto__ as an own property.

Exploits Exist

Fix Available

high

7.5

CVE-2026-42038

Axios is vulnerable to a no_proxy bypass, allowing SSRF attacks due to incomplete hostname normalization.

Exploits Exist

Fix Available

high

7.5

CVE-2026-44486

Axios leaks proxy credentials to a redirect target when using an authenticated proxy configuration with automatic redirects enabled.

Exploits Exist

Fix Available

high

7.5

CVE-2026-44496

Axios is vulnerable to a Regular Expression Denial of Service (ReDoS) via cookie name injection, causing client-side availability degradation.

Exploits Exist

Fix Available

high

7.4

CVE-2026-42033

Axios is vulnerable to prototype pollution, allowing an attacker to intercept and modify JSON responses or hijack the underlying HTTP transport.

Exploits Exist

Fix Available

high

7.4

CVE-2026-42035

Axios is vulnerable to header injection via prototype pollution, allowing an attacker to inject arbitrary HTTP headers into outgoing requests.

Exploits Exist

Fix Available

Mintlify Doc Writer for Python, JavaScript, TypeScript, C++, PHP, Java, C#, Ruby & more

SAFE Assessment

Compliance

Security

Threats

Did you know...