CVE-2024-39338 — Server-Side Request Forgery in axios — CVE Details

HIGH

Server-Side Request Forgery in axios

Published August 12, 2024Updated September 10, 2026Source: osv

What Should I Do?

Address in Next Maintenance Window

Low exploitation probability (2.88%). Schedule for your next planned update.

Summary

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Advisory Timeline

First published August 12, 2024 (791 days ago).
Last revised September 10, 2026 — 759 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update axios to 1.7.4 or later

npm install axios@1.7.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

Package	Ecosystem	Affected	Fixed In
axios	npm	All versions	1.7.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-918
Server-Side Request Forgery (SSRF)MITRE

References

Frequently Asked Questions

What is CVE-2024-39338?: Server-Side Request Forgery in axios This vulnerability has been assigned a severity rating of HIGH.
How do I check if my project is affected by CVE-2024-39338?: CVE-2024-39338 affects axios. It has a 2.9% probability of exploitation within 30 days (EPSS score). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-39338 and 200,000+ other known vulnerabilities.

Severity & Exploitability

EPSS Score (30-day exploit probability)

2.88%

Higher than 86% of vulnerabilities

This places it in the top quartile of EPSS-scored vulnerabilities — 86% of tracked vulnerabilities score at or below it, so it is more likely to be exploited than most of the tracked corpus.

Also Known As

GHSA-8hc4-vh64-cxmj

Related CVEs

CVE-2025-58754
HIGH
Axios is vulnerable to DoS attack through lack of data size check
CVE-2021-3749
HIGH
axios Inefficient Regular Expression Complexity vulnerability
CVE-2025-27152
HIGH
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
CVE-2026-44492
HIGH
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
CVE-2026-101907
HIGH
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
CVE-2026-101900
MEDIUM
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
CVE-2026-101904
MEDIUM
Axios: Header Injection via Inherited headers After Minimal Interceptor
CVE-2026-101908
MEDIUM
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies