漏洞公告

Axios: no_proxy bypass via IP alias allows SSRF

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes

Axios: HTTP adapter streamed responses bypass maxContentLength

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Axios: Header Injection via Prototype Pollution

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

sequoia-git has broken hard revocation handling

webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments

livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

net-imap vulnerable to command Injection via unvalidated Symbol inputs

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

net-imap has quadratic complexity when reading response literals