Axios is installed in roughly 45 million JavaScript projects every week. It is one of the most downloaded packages in the entire npm ecosystem. When a security flaw lands in a library that size, the impact is not theoretical — it is immediate and widespread.
TL;DR
- Axios was incorrectly attaching CSRF protection tokens to cross-origin requests — not just requests to your own API
- An attacker controlling any third-party service your app contacted could silently capture those tokens
- With the token, they could forge authenticated requests on behalf of your users
- Affected Axios versions 0.8.1 through 1.5.1, fixed in 1.6.2 (October 2023)
- CVE-2023-45857, CVSS 6.5 — medium severity, but enormous reach
What are CSRF tokens?
Cross-Site Request Forgery (CSRF) is an attack where a malicious website tricks your browser into making an authenticated request to a different site — one where you are already logged in. Think of it as an attacker clicking "transfer money" on your behalf without you knowing.
The standard defence is a CSRF token: a secret value your server generates and embeds in every form or API call. The server only accepts requests that include the correct token. Since third-party sites cannot read the token from your cookies, they cannot forge requests.
The protection only works if the token stays secret.
What went wrong
Axios has built-in CSRF support. When it detects a XSRF-TOKEN cookie, it automatically attaches it as a header on outgoing requests. This is a useful feature — it makes CSRF protection automatic.
The bug: Axios was attaching this header to all requests, including requests to third-party domains. If your app talked to your own API at api.yourcompany.com and also called an analytics service or a payment provider at a different domain, your CSRF token went to both.
Who was affected
Any front-end application using Axios that made requests to more than one domain. Given that virtually every modern web app talks to multiple APIs, the exposure was extremely broad. The vulnerability had been present since Axios 0.8.1 — many years before it was discovered and reported in October 2023.
The fix
Axios released a patch in version 1.6.2. The fix was straightforward: restrict the XSRF token header to same-origin requests only. For most teams, remediation meant updating one dependency. The challenge, as always, was knowing which projects were still running an affected version — and getting a fix in place quickly after disclosure.
When CVEs land in widely-used packages like Axios, StackRadar shows you which of your repositories are running affected versions and opens automated upgrade PRs — so remediation starts immediately rather than waiting for someone to notice.