Axios Cross-Site Request Forgery Vulnerability

[arthurducept]

npm audit report

axios <=0.30.1
Severity: high
Axios Cross-Site Request Forgery Vulnerability - GHSA-wf5p-g6vw-rhxx
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - GHSA-jr5f-v2jv-69x6
Axios is vulnerable to DoS attack through lack of data size check - GHSA-4hjh-wcwx-xvwj
No fix available
node_modules/axios
@mailpace/mailpace.js *
Depends on vulnerable versions of axios
node_modules/@mailpace/mailpace.js

[pcardoso]

I worked around this by reverting to the older ohmysmtp lib and and importing axios manually.

[charlesetc]

I also hit this -- I think it's been upgraded to critical

axios  <=1.14.0
Severity: critical
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - https://github.com/advisories/GHSA-jr5f-v2jv-69x6
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - https://github.com/advisories/GHSA-43fc-jf86-j433
Axios HTTP/2 Session Cleanup State Corruption Vulnerability - https://github.com/advisories/GHSA-qj83-cq47-w5f8
Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF - https://github.com/advisories/GHSA-3p68-rc4w-qgx5
No fix available
node_modules/axios
  @mailpace/mailpace.js  *
  Depends on vulnerable versions of axios
  node_modules/@mailpace/mailpace.js

[charlesetc]

It may be safe actually and mislabeled by the npm security checker.

This blog post advises to "Roll back all deployments of Axios to safe versions (1.14.0 or 0.30.3 or earlier)."

But the error just says 'axios <=1.14.0' to indicate that it's bad... but the axios getting installed for me was actually "version": "0.21.4", which I think is using the second numbering system indicated in the blog post, and would therefore be fine. I'm not sure why there are two numbering systems for axios: maybe one is the "1.0" version and the other is pre 1.0?

Anyways long story short I think it's actually not unsafe as is.