EUVD-2026-25590
GHSA-xhjh-pmcv-23jw
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
DescriptionGitHub Advisory
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerability is fixed in 1.15.1 and 0.31.1.
AnalysisAI
Axios versions prior to 1.15.1 and 0.31.1 contain a character mapping flaw in the AxiosURLSearchParams.encode() function that reverses safe percent-encoding of null bytes, converting %00 back to raw null bytes. While the standard axios request flow remains unaffected, this vulnerability could enable integrity compromise in edge-case scenarios where encoded parameters are processed by downstream systems expecting percent-encoded values. No public exploit code or active exploitation has been identified.
Technical ContextAI
The vulnerability exists in lib/helpers/AxiosURLSearchParams.js, specifically in the encode() function's charMap object at line 21. Axios uses encodeURIComponent() to safely percent-encode request parameters, including null bytes (\x00), which correctly produces %00. However, a subsequent character mapping step inappropriately includes the entry '%00': '\x00', which reverses this encoding by converting the safe percent-encoded sequence back to a literal null byte. This represents an unsafe decoding operation (CWE-116: Improper Encoding or Escaping of Output) that violates the principle of consistent encoding throughout the request pipeline. The issue affects the promise-based HTTP client library used in both browser and Node.js environments, though the standard axios request flow does not trigger this code path under normal conditions.
RemediationAI
Vendor-released patch: Upgrade axios to version 1.15.1 (for 1.x users) or version 0.31.1 (for 0.x users). These patched versions remove or correct the problematic charMap entry that reverses null byte encoding. Update package.json dependencies and run npm install or yarn install to pull the fixed version. No workarounds are documented for older versions, and given the low practical impact of the standard request flow remaining unaffected, organizations unable to patch immediately should prioritize this as a normal maintenance item rather than emergency remediation. Detailed patching instructions and migration guidance are provided in the GitHub security advisory at https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today