https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 16:57:48 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-101907 <p>Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.</p> <p>Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-101907 https://vulnerability.circl.lu/vuln/ghsa-r4gj-5m52-g5wh <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios exposes `maxRedirects` to limit redirect following, and `maxRedirects: 0` is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API `redirect` mode, so the runtime default of `redirect: &#39;follow&#39;` applies.</p> <p>Applications are affected when they rely on `maxRedirects: 0` and use the fetch adapter, either explicitly or because the runtime selects it.</p> <p>## Impact</p> <p>An attacker who controls the initial URL or a redirecting server can cause a fetch-adapter request to follow a redirect even though the caller configured `maxRedirects: 0`. If the redirect target is reachable only from the application environment, this can expose internal responses or trigger state-changing internal endpoints.</p> <p>This should not be described as unconditional SSRF. The bypass requires a redirect source, such as an attacker-controlled server or open redirect, and an application that trusted `maxRedirects: 0` as the redirect guard.</p> <p>## Affected Functionality</p> <p>Affected:</p> <p>- `adapter: &#39;fetch&#39;`. - Runtime environments where fetch is selected by adapter resolution. - Requests configured with `maxRedirects: 0` but without `fetchOptions.redirect: &#39;manual&#39;` or equivalent runtime-specific redirect control.</p> <p>Not affected:</p> <p>- Node HTTP adapter, which enforces `maxRedirects: 0`. - Requests that do not follow redirects in the underlying fetch implementation because the caller explicitly configured fet…</p> <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios exposes `maxRedirects` to limit redirect following, and `maxRedirects: 0` is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API `redirect` mode, so the runtime default of `redirect: &#39;follow&#39;` applies.</p> <p>Applications are affected when they rely on `maxRedirects: 0` and use the fetch adapter, either explicitly or because the runtime selects it.</p> <p>## Impact</p> <p>An attacker who controls the initial URL or a redirecting server can cause a fetch-adapter request to follow a redirect even though the caller configured `maxRedirects: 0`. If the redirect target is reachable only from the application environment, this can expose internal responses or trigger state-changing internal endpoints.</p> <p>This should not be described as unconditional SSRF. The bypass requires a redirect source, such as an attacker-controlled server or open redirect, and an application that trusted `maxRedirects: 0` as the redirect guard.</p> <p>## Affected Functionality</p> <p>Affected:</p> <p>- `adapter: &#39;fetch&#39;`. - Runtime environments where fetch is selected by adapter resolution. - Requests configured with `maxRedirects: 0` but without `fetchOptions.redirect: &#39;manual&#39;` or equivalent runtime-specific redirect control.</p> <p>Not affected:</p> <p>- Node HTTP adapter, which enforces `maxRedirects: 0`. - Requests that do not follow redirects in the underlying fetch implementation because the caller explicitly configured fet…</p> https://vulnerability.circl.lu/vuln/ghsa-r4gj-5m52-g5wh https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-101907 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-101907