Medium severity5.9NVD Advisory· Published Nov 6, 2020· Updated Jun 17, 2026

CVE-2020-28168

Description

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
axiosnpm	< 0.21.1	0.21.1

Affected products

Axios/Axios
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
Range: >=0.19.0,<=0.21.0
Siemens Foundation/Sinec Ins2 versions
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*range: <1.0
- cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
Axios/Axios NPM packagedescription
osv-coords2 versions
pkg:apk/chainguard/arangodb-3.11 pkg:npm/axios
< 3.11.14.5-r13+ 1 more
- (no CPE)range: < 3.11.14.5-r13
- (no CPE)range: < 0.21.1

cvss	0.384
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

CVE-2020-28168

Description

AI Insight

Affected packages

Affected products

Patches

Vulnerability mechanics

References

News mentions