The Axios JavaScript HTTP client has a flaw in versions 1.17.0 through 1.19.9 where the fetch adapter ignores the maxRedirects: 0 setting. Instead of returning the redirect response, the underlying fetch implementation follows the redirect, allowing the client to reach internal resources or invoke state‑changing endpoints that should be inaccessible when redirects are disabled. This behavior can be exploited to deliver a Server Side Request Forgery attack, where a malicious URL is supplied to an application that then performs a redirect to a protected internal network location.

The vulnerability affects the Axios library across all platforms that employ the fetch adapter, specifically versions 1.17.0 to 1.19.9 inclusive. Applications that embed Axios in web front‑ends, Node.js services, or any environment that uses the fetch adapter for HTTP requests are exposed. Updating the library to 1.20.0 or newer removes the bug.

The CVSS score of 7 identifies the issue as high severity. The EPSS score of < 1% indicates a very low exploitation probability at present, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is remote; it is inferred that an attacker can trigger the redirect by supplying a malicious URL in an Axios request, especially if the application accepts or forwards untrusted URLs. Because the rewritten request can reach internal resources, the risk remains significant for systems that build HTTP calls from user input or redirect‑friendly environments.