-
-
Notifications
You must be signed in to change notification settings - Fork 11.5k
Closed
Description
Is your feature request related to a problem? Please describe.
Barring a migration guide for Axios 1.x, the latest 0.x version of Axios should continue to receive updates for non-breaking security vulnerability resolutions.
Describe the solution you'd like
CVE-2023-45857 affects versions 0.8.1 thru 1.5.1. The fix applied to the 1.x versions in #6028 should be applied to the 0.x branch as well, and released as a patch.
Describe alternatives you've considered
No response
Additional context/Screenshots
Spots that would need mitigation:
https://github.com/axios/axios/blob/880b42e2b8cdd467ce0c6ecd1cf522ef6ef65682/lib/adapters/xhr.js#L143-L156
https://github.com/axios/axios/blob/880b42e2b8cdd467ce0c6ecd1cf522ef6ef65682/test/specs/xsrf.spec.js#L70-L80Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels