CVE-2025-27152: axios Server-Side Request Forgery (SSRF)
CVSS: 7.7v4.0HighAnalyzed
AliasesSUSE-SU-2025:1227-1UBUNTU-CVE-2025-27152DEBIAN-CVE-2025-27152CGA-25cc-xm35-fvw9CGA-2qjh-rw9p-mvwwCGA-2xwv-hhr8-296gCGA-3hrg-7qx9-4f57CGA-4374-pv5m-wj5qCGA-4pmv-33p7-64rjCGA-55gr-4h9q-j4w3CGA-55m9-vh7h-fqpwCGA-5gwc-rqpc-jcw8CGA-5q9m-f2qw-2459CGA-76gx-fgq8-h23cCGA-7jcg-pm6x-7p3xCGA-7jcq-fcmp-g89gCGA-84wp-52ww-5xf5CGA-8c75-p3jx-6x7qCGA-9948-jcwj-x5xmCGA-9h65-g754-4jmjCGA-fpmc-fw88-6pxpCGA-fqr7-jm5j-vpfjCGA-g55j-7wwq-crrfCGA-g866-mg3g-j3m8CGA-g9m7-988j-c23qCGA-gh3c-92w8-chj8CGA-jw5h-cj7q-659vCGA-m259-6qxf-pqw3CGA-m58r-qxqc-rh85CGA-m988-cqjw-wv4vCGA-m9w6-79jp-jfh8CGA-mh44-6xpf-9xrpCGA-pch9-fp2x-23w9CGA-q92p-m4qf-4vv6CGA-qh3h-fcxp-26qwCGA-rg9f-cqhv-6m6fCGA-vfxw-hpvc-8vp2CGA-vh97-2mpc-9vp9CGA-wrqj-9gg7-vr8jCGA-wxvx-4j22-v8fvGHSA-jr5f-v2jv-69x6CGA-22cx-w4hh-8jgwCGA-259m-7m5c-2cj7CGA-2rvp-724p-qm8hCGA-3gj7-9ch4-wrffCGA-3r2f-f273-w72jCGA-3x63-94x2-gm5mCGA-43j6-qh55-w738CGA-4565-qpp6-69mpCGA-55x9-5pmw-j85vCGA-5h7m-gw3c-jg5pCGA-5mm2-48f4-w763CGA-5p36-pp39-mjq7CGA-5v3h-5q63-vxphCGA-5x9q-5pmj-27xxCGA-6qwx-xmj2-vc2vCGA-6vrj-hvp7-jmwqCGA-764p-pwqv-3qgjCGA-7j8j-c6fh-84c4CGA-8p86-pp2h-gfw6CGA-8qqq-3wmc-p7vhCGA-9368-gf9x-777mCGA-998x-322p-rh47CGA-cg23-2hm7-chf3CGA-cwhj-rxx5-wrxpCGA-f8rm-m99q-cpvxCGA-fmcr-hjwf-pqg6CGA-g7w4-3c3w-mvw9CGA-g9h9-9wp5-r3p8CGA-gfc8-4qrg-384hCGA-grx2-9f89-v4mgCGA-hmr8-xh5x-w9fgCGA-hrv5-x9g4-r2mpCGA-j7p3-36gw-rjf5CGA-jf4p-9pjx-8442CGA-jjhf-rmqr-76c3CGA-jqwm-8xx6-682xCGA-m7j4-w3wg-6jf2CGA-m9mq-px6j-g6r8CGA-mf37-hwvm-gfqcCGA-mqjj-27r6-65cpCGA-p26q-h4pm-hmchCGA-p4w3-92gm-3hh5CGA-p4x8-g84g-w25xCGA-ph65-55fr-57mcCGA-q3cr-2874-pvm3CGA-q3hr-wjgp-4gxhCGA-r65w-5h95-28c7CGA-rmqq-642r-vx8rCGA-rx7q-4rcp-83xfCGA-rx8c-m6mh-qwj7CGA-rxvr-fx97-m77wCGA-v4vp-86qx-p2h8CGA-vjq6-vj98-r9chCGA-vrq6-6f6p-9jcwCGA-w243-vh7p-7m59CGA-w439-vfq3-jjw3CGA-wfjc-7fcr-g45hCGA-wrjp-vqmm-mvvpCGA-x2wc-5f8v-6h5fCGA-x6mv-4rx5-c8vjCGA-xj36-9pw9-wmqxCGA-xx7p-c3xf-qrxq
Published 07-03-2025Last modified 07-03-2025
Vulnerability summary
CVE-2025-27152 is a high (CVSS 7.7) Server-Side Request Forgery (SSRF) vulnerability in axios. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.7/10
010
High · v4.0 (CVE.org)EPSS score
0.79%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 3 · Related 10Timeline
- 07-03-2025PublishedVulnerability first disclosed.
- 07-03-2025Last modifiedVulnerability information updated.
Description
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
CVSS metrics
9 scores · 7 sources · 2 versionsHigh 7.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:PSources6 sources · 7.7–8.7
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.02 pp
From 0.78% on 19-09-2026
19-09-202619-10-2026
EPSS score0.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAxios
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard50 products
- airflow-2< 2.11.0-r15
- arangodb-3.11< 3.11.14.5-r13
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Wolfi20 products
- jitsucom-jitsu< 2.8.6-r2
- jitsucom-jitsu-console< 2.8.6-r2
- jitsucom-jitsu-rotor< 2.8.6-r2
- kubeflow-centraldashboard< 1.9.2-r5
- kubeflow-pipelines< 2.4.0-r5
Axios1 product
- axios< 1.8.2 | < 0.30.0 | ≥ 1.0.0, ≤ 1.7.9
Debian1 product
- node-axiosAll versions (No fix recorded) | < 1.8.4+dfsg-1
Npm1 product
- axios≥ 1.0.0, < 1.8.2 | < 0.30.0
Opensuse1 product
- pgadmin4&distro=openSUSE Leap 15.6< 8.5-150600.3.9.1
Suse1 product
- pgadmin4&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 8.5-150600.3.9.1
Ubuntu1 product
- node-axiosAll versions (No fix recorded)
8 vendors · 76 products
References
15 links- github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
