CVE-2025-27152 in axios
Summary
by MITRE • 03/07/2025
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/28/2025
The vulnerability identified as CVE-2025-27152 affects the axios HTTP client library, which is widely used for making HTTP requests in both browser and node.js environments. This security flaw stems from how the library handles absolute URLs versus protocol-relative URLs, creating potential pathways for server-side request forgery and sensitive data exposure. The issue manifests when developers pass absolute URLs to axios requests, even when a baseURL has been configured, leading to unexpected behavior that can be exploited by malicious actors. The vulnerability impacts the fundamental request routing mechanism within the library, potentially allowing attackers to bypass intended security boundaries.
The technical implementation flaw occurs within axios's URL resolution logic where the library fails to properly respect the configured baseURL when absolute URLs are provided. This creates a scenario where the HTTP client ignores the base configuration and directly uses the absolute URL supplied by the user, potentially redirecting requests to unintended targets. The vulnerability is particularly concerning because it operates at the network communication layer, where it can be leveraged to access internal resources or systems that should normally be protected from external access. This behavior directly violates the principle of least privilege and can lead to unauthorized data access or system compromise.
The operational impact of this vulnerability extends across both client-side and server-side implementations of axios, making it particularly dangerous as it affects the entire ecosystem of applications using this library. Attackers could exploit this flaw to perform server-side request forgery attacks by crafting absolute URLs that point to internal services or resources, potentially leading to credential leakage, data exfiltration, or further compromise of internal systems. The vulnerability also poses risks to application security when developers inadvertently pass sensitive URLs or when applications process user input that gets passed directly to axios without proper validation. This issue represents a significant concern for organizations relying on axios for their HTTP communication needs, as it can be exploited to bypass network security controls and access protected resources.
The fix for CVE-2025-27152 was implemented in version 1.8.2 of the axios library, addressing the URL resolution logic to properly respect the baseURL configuration even when absolute URLs are provided. Security practitioners should immediately update to this version or newer to mitigate the risk of exploitation. Organizations should conduct thorough code reviews to identify any instances where absolute URLs might be passed to axios requests, particularly in scenarios involving user input or dynamic URL construction. The vulnerability aligns with CWE-918, which covers server-side request forgery issues, and could be categorized under ATT&CK technique T1190 for exploitation of remote services. Additionally, this issue highlights the importance of proper input validation and URL handling in web applications, reinforcing the need for secure coding practices and regular security assessments of third-party dependencies.