Skip to content

Patch axios security vulnerabilities.#2725

Merged
jbocce merged 1 commit into
cornerstonejs:mainfrom
jbocce:fix/OHIF-2593-axios-security-patch
May 6, 2026
Merged

Patch axios security vulnerabilities.#2725
jbocce merged 1 commit into
cornerstonejs:mainfrom
jbocce:fix/OHIF-2593-axios-security-patch

Conversation

@jbocce
Copy link
Copy Markdown
Collaborator

@jbocce jbocce commented May 6, 2026

Context

See...

  1. Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
  2. Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
  3. Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
  4. Axios: Header Injection via Prototype Pollution

Changes & Results

Updated the axios dependency to version 1.15.2.

Testing

Automated tests should pass.

Checklist

PR

  • My Pull Request title is descriptive, accurate and follows the
    semantic-release format and guidelines.

Code

  • My code has been well-documented (function documentation, inline comments,
    etc.)

Public Documentation Updates

  • The documentation page has been updated as necessary for any public API
    additions or removals.

Copy link
Copy Markdown

@claude claude Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

@jbocce jbocce merged commit 93d0958 into cornerstonejs:main May 6, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant