GHSA-xhjh-pmcv-23jw: Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsSummaryThe `encode()` function in `lib/helpers/AxiosURLSearchParams.js` contains a character mapping (`charMap`) at line 21 that **reverses** the safe percent-encoding of null bytes. After `encodeURIComponent('\x00')` correctly produces the safe sequence `%00`, the charMap entry `'%00': '\x00'` converts it back to a raw null byte.This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.**Severity:** Low (CVSS 3.7)
**Affected Versions:** All versions containing this charMap entry
**Vulnerable Component:** `lib/helpers/AxiosURLSearchParams.js:21`CWE**CWE-626:** Null Byte Interaction Error (Poison Null Byte)**CWE-116:** Improper Encoding or Escaping of OutputCVSS 3.1**Score: 3.7 (Low)**Vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N`| Metric | Value | Justification |
|---|---|---|
| Attack Vector | Network | Attacker controls input parameters remotely |
| Attack Complexity | High | Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No user interaction required |
| Scope | Unchanged | Impact limited to HTTP request URL |
| Confidentiality | None | No confidentiality impact |
| Integrity | Low | Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser |
| Availability | None | No availability impact |Vulnerable Code**File:** `lib/helpers/AxiosURLSearchParams.js`, lines 13-26Why the Standard Flow Is NOT AffectedProof of ConceptVerified PoC OutputImpact Analysis**Primary impact is limited** because the standard axios request flow is not affected. However:**Direct API users:** Applications using `AxiosURLSearchParams` directly for custom serialization are affected**Custom paramsSerializer:** A `paramsSerializer.encode` that delegates to the internal encoder triggers the bug**Code defect signal:** The directional inconsistency in charMap is a clear coding error with no legitimate use caseIf null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.Recommended FixRemove the `%00` entry from charMap and update the regex:Resources[CWE-626: Null Byte Interaction Error](https://cwe.mitre.org/data/definitions/626.html)[CWE-116: Improper Encoding or Escaping of Output](https://cwe.mitre.org/data/definitions/116.html)[OWASP: Embedding Null Code](https://owasp.org/www-community/attacks/Embedding_Null_Code)[Axios GitHub Repository](https://github.com/axios/axios)Timeline| Date | Event |
|---|---|
| 2026-04-15 | Vulnerability discovered during source code audit |
| 2026-04-16 | Report revised: documented standard-flow limitation, corrected CVSS |
| TBD | Report submitted to vendor via GitHub Security Advisory |
CVSS v3.1: 3.7