CVE-2025-27152

What it actually does

Axios request construction can allow an absolute URL supplied to a request call to override the configured baseURL. Code that assumes all requests are constrained to a trusted base URL may instead send traffic to an attacker-controlled or internal URL. In server-side applications this can become SSRF, allowing requests to cloud metadata services, loopback services, private network addresses, or internal APIs reachable from the application server. In both server-side and browser contexts, headers, cookies, API keys, bearer tokens, or other credentials configured on the axios instance may be sent to the unintended destination, causing credential leakage.

Why it matters to the business

Applications that use axios to call trusted back-end services may be tricked into contacting untrusted or internal systems, which can expose secrets, cloud credentials, internal data, or privileged service responses. Although this issue is not listed in CISA KEV, has no confirmed mature public exploit in the provided data, and has a relatively low EPSS score of 0.00763, axios is widely used in JavaScript applications, so vulnerable dependency usage can be widespread across web front ends, Node.js services, serverless functions, and internal automation. The reported association with payroll-themed threat activity increases concern for applications that process employee, finance, identity, or payment workflows.

How an attack unfolds

An attacker first identifies an application feature that accepts, derives, or forwards a URL or path into an axios request. The application may create an axios instance with a trusted baseURL and security-sensitive default headers, such as Authorization, X-API-Key, session cookies, or service credentials. Instead of providing a relative path, the attacker supplies a fully qualified absolute URL such as an attacker-controlled HTTPS endpoint or an internal address. In vulnerable axios behavior, the absolute URL is used as the request target despite baseURL being configured. If the target is attacker controlled, the attacker receives the outbound request and any credentials attached by the application. If the target is internal, the attacker may use the application as a network pivot to query loopback services, cloud metadata endpoints, private APIs, or administrative interfaces. Follow-on activity may include replaying stolen credentials, enumerating internal services, retrieving cloud role credentials, or using exposed tokens for account takeover or data access. Threat reporting referencing Storm-2755 Payroll Pirate Attacks should prompt added scrutiny of payroll, HR, identity, and payment-related applications that combine user-influenced URLs with axios instances carrying privileged credentials.

How to fix it

Upgrade axios to a fixed version. For source builds, use axios/axios commit a9f7689b0c4b6d68c7f587c3aa376860da509d94 or later. For package-managed JavaScript projects, upgrade to the patched axios release corresponding to that fix, commonly axios 1.8.2 or later where available, and regenerate lockfiles. Audit direct and transitive dependency trees for bundled or pinned axios copies. As defense in depth, validate any URL passed to axios, reject absolute URLs where only relative paths are expected, enforce an allowlist of destination schemes and hostnames, block link-local, loopback, multicast, and private network ranges for server-side URL fetches, and avoid placing sensitive default credentials on axios instances that process user-influenced request targets. Apply outbound egress controls so application workloads cannot directly reach cloud metadata endpoints or arbitrary internal networks unless explicitly required.

How to confirm the fix worked

Confirm that dependency manifests and lockfiles resolve axios to a patched version or to source including commit a9f7689b0c4b6d68c7f587c3aa376860da509d94 or later. Use software composition analysis, npm/yarn/pnpm lockfile review, and container image scans to identify stale axios copies. Add unit or integration tests that create an axios instance with baseURL set to a trusted host and then attempt a request using an absolute URL; the test should verify that the request is rejected, blocked by application validation, or does not leak sensitive default headers to the attacker-controlled destination. Review code for axios calls where request URL values come from request parameters, webhook payloads, import files, redirect targets, tenant configuration, integration settings, or database-stored URLs. Validate network controls by attempting to reach cloud metadata and loopback addresses from application runtimes and confirming those requests are denied unless explicitly required.

Typical attack path

1. Find an application endpoint, background job, webhook handler, proxy feature, import function, or integration that passes user-controlled input into axios.
2. Provide an absolute URL instead of the expected relative path.
3. Cause vulnerable axios behavior to send the request to the supplied absolute URL despite a configured baseURL.
4. Receive leaked headers or tokens on an attacker-controlled host, or direct the request toward internal network resources.
5. Use SSRF to probe loopback, link-local, cloud metadata, private RFC1918 addresses, or internal APIs reachable from the application runtime.
6. Replay captured credentials or use retrieved metadata/API responses for privilege escalation, data access, or lateral movement.

How to detect it

To determine whether this was already exploited, correlate application access logs, API gateway logs, WAF events, reverse proxy logs, application debug/error logs, DNS resolver logs, outbound proxy logs, firewall flow logs, cloud VPC flow logs, and endpoint/container telemetry. Look for requests where user-supplied fields contain full URLs instead of expected relative paths, especially URLs pointing to loopback, link-local, private IP ranges, cloud metadata services, or unfamiliar external domains. On servers, investigate outbound HTTP requests from Node.js processes to 169.254.169.254, metadata.google.internal, localhost, 127.0.0.1, ::1, RFC1918 address ranges, or unexpected internet hosts shortly after inbound requests containing url, uri, redirect, callback, webhook, endpoint, path, target, next, returnUrl, or import parameters. Review outbound HTTP headers captured by egress proxies for Authorization, Cookie, X-API-Key, X-Amz-Security-Token, or other secrets being sent to non-allowlisted hosts. In cloud environments, inspect cloud audit logs for unusual metadata credential use, new API calls from application instance roles, anomalous STS token usage, or access from unexpected source IPs after suspicious outbound requests. For payroll or finance-facing applications, pay special attention to URL manipulation attempts, credential replay, account changes, payment destination changes, or identity events that align with reported Storm-2755 Payroll Pirate Attacks activity.

• 169.254.169.254
• http://169.254.169.254
• https://169.254.169.254
• /latest/meta-data/
• /latest/meta-data/iam/security-credentials/
• 169.254.169.254/latest/meta-data/iam/security-credentials
• metadata.google.internal
• http://metadata.google.internal
• /computeMetadata/v1/
• Metadata-Flavor: Google
• 169.254.169.254/metadata/instance
• Metadata: true
• http://127.0.0.1
• https://127.0.0.1
• http://localhost
• https://localhost
• http://[::1]
• http://0.0.0.0
• http://10.
• http://172.16.
• http://172.17.
• http://172.18.
• http://172.19.
• http://172.20.
• http://172.21.
• http://172.22.
• http://172.23.
• http://172.24.
• http://172.25.
• http://172.26.
• http://172.27.
• http://172.28.
• http://172.29.
• http://172.30.
• http://172.31.
• http://192.168.
• axios/
• baseURL
• Authorization: Bearer
• X-API-Key:
• X-Amz-Security-Token
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_SESSION_TOKEN

What your security team should do

• Prioritize inventory of all applications, containers, serverless functions, and front-end bundles using axios, including transitive and vendored copies.
• Upgrade axios to a patched release or source revision containing commit a9f7689b0c4b6d68c7f587c3aa376860da509d94; verify lockfiles and deployed artifacts, not just package manifests.
• Search code for axios instances with baseURL plus default Authorization, Cookie, X-API-Key, or similar sensitive headers, especially where request URLs can be influenced by users or external integrations.
• Implement application-level URL validation that rejects absolute URLs when relative paths are expected and enforces strict destination allowlists for legitimate outbound fetch features.
• Deploy egress restrictions to block application workloads from reaching 169.254.169.254, cloud metadata hostnames, localhost, private address ranges, and unapproved external domains.
• Review proxy, webhook, import, integration, payroll, HR, finance, and identity workflows for SSRF exposure and credential leakage risk.
• Monitor outbound HTTP logs, DNS logs, WAF/API logs, and application logs for absolute URL payloads, metadata-service access attempts, and requests to attacker-controlled or unusual destinations.
• Rotate credentials if logs show sensitive headers were sent to untrusted domains or if metadata endpoints or internal APIs were accessed unexpectedly.