Axios lists 0.x as supported, but its advisories show fixes ship only in new 0.x releases, now 0.34.0. What it means for pinned code, and the paid option.
What Axios's 2026 advisories show
| 0.x release that carried the fixes | Published to npm | Examples of advisories fixed there |
|---|---|---|
| 0.31.1 | 2026-04-19 | CVE-2026-42043 (NO_PROXY patch bypass), CVE-2026-42041 (authentication bypass via a prototype-pollution gadget), CVE-2026-44495 |
| 0.32.0 | 2026-05-04 | CVE-2026-44492 (NO_PROXY bypass with IPv4-mapped IPv6), CVE-2026-44486 and CVE-2026-44487 (Proxy-Authorization leaks on redirect) |
| 0.33.0 | 2026-06-14 | CVE-2026-69124 (inherited proxy after interceptor config cloning), CVE-2026-69123, CVE-2026-68944 |
| 0.34.0 | 2026-09-16 | GHSA-x97p-jq2g-jp4f (prototype-pollution gadget in toFormData options, affected from 0.28.0), GHSA-9fr6-4gfg-395g (affected from 0.27.2) |
What's covered
- What Axios's 2026 advisories show
- One 0.x flaw with only a 1.x fix
- Why so much code is still on 0.x
- The commercial 0.x option
- What to do
Full guide with every version, risk scores, and live updates: https://endoflife.ai/article-axios-0x-support-2026
Top comments (0)