[aikido-autofix]

Overview

Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>

Upgrade axios to fix proxy bypass/SSRF, prototype pollution, credential leakage on redirects, and XSRF token exposure vulnerabilities.

Changes

✅ 9 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-62718	HIGH	[axios] Improper hostname normalization in NO_PROXY rule checking allows requests to loopback addresses (localhost., [::1]) to bypass proxy protections, enabling proxy bypass and potential SSRF attacks against internal services. This vulnerability permits attackers to reach sensitive services despite configured NO_PROXY protections.
CVE-2026-40175	HIGH	[axios] A prototype pollution vulnerability in a third-party dependency can be exploited to inject unsanitized header values into outbound HTTP requests. This could allow attackers to manipulate request headers for potential information disclosure or request forgery attacks.
AIKIDO-2026-291630	HIGH	[axios] HTTP adapter fails to strip custom credential headers (like X-API-Key) during cross-origin redirects, potentially leaking API keys and authentication tokens to unintended hosts. This information disclosure vulnerability affects shared environments where secret headers are set by default.
CVE-2026-44495	MEDIUM	[axios] Contains prototype-pollution gadgets in request config processing that can be exploited if Object.prototype is already polluted by another vulnerability, potentially allowing arbitrary code execution or request manipulation. Requires a separate prototype-pollution vulnerability or attacker control over Object.prototype to be exploitable.
CVE-2023-45857	MEDIUM	[axios] An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
CVE-2026-25639	MEDIUM	[axios] The mergeConfig function crashes with a TypeError when processing configuration objects containing proto as an own property, allowing attackers to trigger denial of service. An attacker can exploit this by providing a malicious configuration object created via JSON.parse().
AIKIDO-2026-38469	MEDIUM	[axios] Accepts malformed HTTP/HTTPS URLs without // (e.g., https:internal.example), allowing attackers to bypass URL allowlists or WAF checks and reach unintended hosts. The vulnerability enables URL validation bypass through silent normalization of invalid URLs.
CVE-2025-27152	MEDIUM	[axios] Axios sends requests to absolute URLs even when baseURL is configured, bypassing intended routing and potentially causing Server-Side Request Forgery (SSRF) and credential leakage in both server and client environments.
AIKIDO-2023-10001	LOW	[axios] Prototype pollution vulnerability in the formDataToJSON function allows attackers to modify object prototypes. Additionally, a ReDoS vulnerability in combineURLs can cause denial of service through malicious input.

⚠️ Breaking changes analysis not available for: axios

🤖 Remediation details

Fix axios transitive vulnerability via resolutions override

Short summary

This PR remediates multiple high- and medium-severity vulnerabilities in the transitive dependency axios (resolved at 0.27.2, below the required fix floor of 1.20.0). The fix is applied via a resolutions entry in shared-actions/send-deployment-event/package.json, with the corresponding lockfile entry in shared-actions/send-deployment-event/yarn.lock updated to reflect the new resolved version.

axios

axios@0.27.2 is pulled in transitively by the direct dependency analytics-node@6.2.0, which declares axios@^0.27.2 — a range that cannot resolve to any 1.x release. Because analytics-node@6.2.0 is the only published version of that package, no parent bump path exists to admit a patched axios. A resolutions override ("axios": "1.20.0") was added to shared-actions/send-deployment-event/package.json as a last resort, forcing the lockfile to resolve axios to 1.20.0 — the minimum version that clears all identified advisories, including the additional CVEs (CVE-2026-101898 through CVE-2026-101909) requiring FixedVersion 1.20.0 that were surfaced during review.

Version changes

Package	From	To	Why updated
axios	0.27.2	1.20.0	Transitive CVE fix via resolutions override (parent analytics-node@6.2.0 cannot admit axios 1.x)

Testing

Docs

• Yes! ✋ I have updated the documentation.

For contributions to the Typeform/.github repo

Note: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!

Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.

• This PR only changes an existing workflow.
• This PR adds a new workflow that is needed in a public Typeform repository.

[pr-auditor]

✅ Security Analysis Results

No security issues found. 2 files reviewed.

---

@pr-auditor rescan to re-run · Powered by Claude Sonnet 5.5 · Docs · #security-engineering-team