The Axios HTTP client contains a flaw in the encode() function used for URL query string generation. The function contains a mapping that intentionally reverses percent‑encoded null bytes, turning the safe %00 sequence back into a raw null byte. This allows an attacker to inject a null byte into data that is passed through the encoder, potentially corrupting downstream string handling or truncating values at null boundaries. While the vulnerability does not affect the standard request flow of Axios, it could be exploited in custom usage patterns or by libraries that reuse the encoder without full control.

Axios releases before 1.15.1 and 0.31.1 are affected. The issue exists in the Axios library for both browser and Node.js environments. Any deployment that uses Axios directly or through a dependency graph that pulls in the vulnerable version is impacted.

The CVSS score of 3.7 indicates moderate severity. The EPSS score is below 1%, indicating a low probability of active exploitation, and Axios is not listed in CISA KEV catalog. The likely attack vector is via crafted URLs or direct usage of the encode() function to inject a raw null byte. Because the injection could cause data truncation or corruption, the impact is primarily data integrity rather than confidentiality or availability.