Skip to content

Pensar - Upgrade axios from 1.7.2 to 1.8.2#2

Open
pensarapp[bot] wants to merge 1 commit intomainfrom
pensar-auto-fix-jxIA
Open

Pensar - Upgrade axios from 1.7.2 to 1.8.2#2
pensarapp[bot] wants to merge 1 commit intomainfrom
pensar-auto-fix-jxIA

Conversation

@pensarapp
Copy link

@pensarapp pensarapp bot commented Oct 16, 2025

Secured with Pensar

Upgrading axios from 1.7.2 to 1.8.2

Fixes Summary

File Fix Explanation
 /nextjs/package.json 
Upgrading to version 1.8.2 addresses the critical SSRF and credential leakage vulnerability that was present in 1.7.4. In version 1.8.2, axios adds verification to ensure that when a baseURL is set, any absolute URL passed to a request is validated and must start with the expected baseURL before the request is sent. This change prevents the bypassing of security controls that could lead to unauthorized disclosure of sensitive headers and internal service access. Additionally, improvements have been made to how data URIs are handled, reducing the risk of denial-of-service attacks that were possible due to unbounded memory allocation. Upgrading to 1.8.2 is therefore the minimum necessary change to fully mitigate these vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants