CVE-2024-39338

7.5 highEPSS 1.2%

High (7.5) in axios axios. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in axios 1.7.4.

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Severity

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2024-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-8hc4-vh64-cxmj	npm	axios	>=1.3.2 <1.7.4	1.7.4