CVE-2025-27152
Fixed in a distro release EPSS <1%CVSS 7.7
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.8.2 |
| npm | axios | 0.30.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.0-r15 |
| Chainguard | arangodb-3.11 | 3.11.14.5-r13 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | jitsucom-jitsu | 2.8.6-r2 |
| Chainguard | jitsucom-jitsu-console | 2.8.6-r2 |
| Chainguard | jitsucom-jitsu-rotor | 2.8.6-r2 |
| Chainguard | kubeflow-centraldashboard | 1.9.2-r5 |
| Chainguard | kubeflow-pipelines | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-apiserver | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-cache_server | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-frontend | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.4.0-r5 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.4.0-r5 |
| Chainguard | lerna | 8.2.1-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.3-r0 |
| Chainguard | opensearch-dashboards-2 | 2.19.4-r0 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.2-r4 |
| Chainguard | prism | 5.12.1-r4 |
| Chainguard | tileserver-gl | 5.1.3-r2 |
| Chainguard | tileserver-gl-compat | 5.1.3-r2 |
| Chainguard | tileserver-gl-fips | 5.1.3-r2 |
| Chainguard | tileserver-gl-fips-compat | 5.1.3-r2 |
| Debian 12 | node-axios | no fix |
| Debian 13 | node-axios | 1.8.4+dfsg-1 |
| Debian 14 | node-axios | 1.8.4+dfsg-1 |
| SUSE Enterprise Storage 7.1 | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | pgadmin4 | 8.5-150600.3.9.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Manager Proxy 4.3 | pgadmin4 | 4.30-150300.3.18.1 |
| SUSE Manager Server 4.3 | pgadmin4 | 4.30-150300.3.18.1 |
| Ubuntu 25.10 | node-axios | no fix |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | jitsucom-jitsu | 2.8.6-r2 |
| Wolfi | jitsucom-jitsu-console | 2.8.6-r2 |
| Wolfi | jitsucom-jitsu-rotor | 2.8.6-r2 |
| Wolfi | kubeflow-centraldashboard | 1.9.2-r5 |
| Wolfi | kubeflow-pipelines | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-apiserver | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-cache_server | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-frontend | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.4.0-r5 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.4.0-r5 |
| Wolfi | lerna | 8.2.1-r1 |
| Wolfi | prism | 5.12.1-r4 |
| Wolfi | tileserver-gl | 5.1.3-r2 |
| Wolfi | tileserver-gl-compat | 5.1.3-r2 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.9.1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git163.87ee3570-1.1 |