Skip to content

Upgrading axios 0.32 to 0.33

Review needed0.32.0 → 0.33.0Security8Changed1Other3

Full comparisonBack to axios
Review neededUpgrade verdict

1 behavior change and 7 security fixes.

In plain terms
  • Axios: Nested axios option objects can consume polluted prototype values
  • Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
  • Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
  • Axios: Prototype pollution gadgets can alter axios request construction
Must act Top 3 of 7 that need code or config changes

What you must change

Security7
Axios: Nested axios option objects can consume polluted prototype values
authparamsproxydataModerate
0.33.0GitHub AdvisoryOriginalView source
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
High
0.33.0GitHub AdvisoryOriginalView source
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Moderate
0.33.0GitHub AdvisoryOriginalView source
Axios: Prototype pollution gadgets can alter axios request construction
Moderate
0.33.0GitHub AdvisoryOriginalView source
Axios form serializer maxDepth bypass via {} metatoken
Moderate
0.33.0GitHub AdvisoryOriginalView source
Axios: Excessive recursion in formDataToJSON can cause denial of service
Moderate
0.33.0GitHub AdvisoryOriginalView source
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Moderate
0.33.0GitHub AdvisoryOriginalView source