REDHAT-BUG-2487948: High severity npm/axios vulnerability
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 0.32.0 - Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487948?
The severity of REDHAT-BUG-2487948 is classified as high with a rating of 7.
How do I fix REDHAT-BUG-2487948?
To fix REDHAT-BUG-2487948, you must upgrade Axios to version 0.32.0 or 1.16.0 or later.
What impact does REDHAT-BUG-2487948 have on security?
REDHAT-BUG-2487948 could potentially expose sensitive Proxy-Authorization headers during specific proxy redirect scenarios.
Which versions of Axios are affected by REDHAT-BUG-2487948?
Versions of Axios prior to 0.32.0 and 1.16.0 are affected by REDHAT-BUG-2487948.
What is Axios in relation to REDHAT-BUG-2487948?
Axios is a promise-based HTTP client for the browser and Node.js that is impacted by the issues described in REDHAT-BUG-2487948.