High
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Type: advisorySource: Official CVE List
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set…
Products: axiosCVEs: CVE-2026-101907