CVE-2026-101907: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
Which Axios deployments are affected?
Axios versions from 1.17.0 up to, but not including, 1.20.0 are affected when requests use the fetch adapter and set maxRedirects to 0.
What must occur for exploitation to be possible?
A request using the fetch adapter with maxRedirects: 0 must receive a redirect response. The underlying fetch implementation follows that redirect, potentially allowing access to internal responses or state-changing internal endpoints.
Is setting maxRedirects to 0 an effective mitigation on affected versions?
No. On affected versions, the fetch adapter does not enforce maxRedirects: 0, so redirects can still be followed.
How can this be remediated?
Upgrade Axios to version 1.20.0, which fixes the redirect-policy enforcement issue.