CVE-2024-39338: Axios

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Affected products

• Axios Axios: from 1.3.2, before 1.7.4 (fixed in 1.7.4)

Published 2024-08-12. Last modified 2026-06-17.