vulns.co
/
GKData.io MCP

Axios · 2 min read

Axios: URL construction does not establish destination authority

An Axios base URL does not by itself restrict where requests can go: an absolute URL can select a different destination. The CVE-2025-27152 advisory describes possible server-side request forgery when applications accept unvalidated caller-controlled URLs, and possible disclosure of sensitive headers to an unintended recipient. Its controlled demonstration retrieved content from a different destination; it did not establish a production compromise.

Open the reference Maintainer AdvisoryReviewed 2026-10-05

How to use this reference

Current official Axios documentation treats baseURL as a convenience rather than an access-control boundary. Absolute destinations can override it by default; disabling that behavior does not constrain relative-path normalization. Editorial lesson: validate the resolved destination against application policy, scope credentials to their intended recipients, and apply least-privilege egress controls. Review the selected transport and deployed version together. A software upgrade or configuration toggle alone does not make arbitrary caller input safe.

Before reading

  • URL resolution and the distinction between construction and destination authorization
  • Server-side HTTP clients and credential-bearing request configuration

Context and limits

  • SSRF requires server-side execution and unvalidated caller influence over the requested URL. Credential exposure additionally requires sensitive request configuration and delivery to an unintended recipient. The advisory also covers client-side use, which alone is not SSRF.
  • The maintainer lists affected versions <=1.7.9 and <=0.29.0, while the database lists >=1.0.0, <1.8.2 and <0.30.0. Both identify 1.8.2 and 0.30.0 as patched. The range disagreement is preserved; intervening versions are not silently classified.
  • The v1.8.2 release and tagged changelog describe HTTP-adapter support for the absolute-URL option on March 7, 2025. The v0.30.0 release, dated March 26, 2025, identifies the backport. These are software events, not educational-resource edition dates or claims about the latest safe release.
  • jasonsaayman published the advisory; lambdasawa is credited as Reporter. No separate author byline was established, so authors remains empty.
  • The database shows a November 27, 2025 update; it does not change the original March 7 publication. Current request-configuration guidance is living documentation, not proof of what the March release documented.
  • No production incident, account takeover or qualifying individual award is established. The reported demonstration and conditional credential risk remain separate. Learning prerequisites and generalized design guidance are editorial; this educational case grants no testing authorization.

Sources and provenance

  1. Axios absolute-URL security advisory GHSA-jr5f-v2jv-69x6 Axios · reviewed 2026-10-05
  2. GitHub Advisory Database entry for CVE-2025-27152 GitHub Advisory Database · reviewed 2026-10-05
  3. Axios v1.8.2 release notes Axios · reviewed 2026-10-05
  4. Axios tagged changelog for v1.8.2 Axios · reviewed 2026-10-05
  5. Axios v0.30.0 backport release notes Axios · reviewed 2026-10-05
  6. Axios request configuration: destination and base-URL semantics Axios · reviewed 2026-10-05
  7. Axios official repository and documentation links Axios · reviewed 2026-10-05

Record reviewed 2026-10-05. Snapshot cb017eaea66e. Open the complete JSON contract.

GitHub snapshot 2026-10-12

cb017eaea66e · JSON exports & schemas · CC BY 4.0 content / MIT software