Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.

Affected: npm: axios

## Summary

Axios exposes `maxRedirects` to limit redirect following, and `maxRedirects: 0` is used by applications as a redirect-based SSRF guard. The Node HTTP adapter enforces this option. The fetch adapter does not read it and does not set a Fetch API `redirect` mode, so the runtime default of `redirect: 'follow'` applies.

Applications are affected when they rely on `maxRedirects: 0` and use the fetch adapter, either explicitly or because the runtime selects it.

## Impact

An attacker who controls the initial URL or a redirecting server can cause a fetch-adapter request to follow a redirect even though the caller configured `maxRedirects: 0`. If the redirect target is reachable only from the application environment, this can expose internal responses or trigger state-changing internal endpoints.

This should not be described as unconditional SSRF. The bypass requires a redirect source, such as an attacker-controlled server or open redirect, and an application that trusted `maxRedirects: 0` as the redirect guard.

## Affected Functionality

Affected:

- `adapter: 'fetch'`. - Runtime environments where fetch is selected by adapter resolution. - Requests configured with `maxRedirects: 0` but without `fetchOptions.redirect: 'manual'` or equivalent runtime-specific redirect control.

Not affected:

- Node HTTP adapter, which enforces `maxRedirects: 0`. - Requests that do not follow redirects in the underlying fetch implementation because the caller explicitly configured fet…

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization axios: axios: Unintended HTTP method override via prototype pollution gadget axios: Axios: Denial of Service via malformed data URLs axios: Axios: HTTP header injection via inherited prototype properties axios: axios: Request socket hijacking via inherited createConnection property axios: axios: Denial of Service via crafted redirect hostname axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution axios: axios: Denial of Service via prototype pollution gadget in form serialization

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.