CVE-2024-57965 is a disputed entry for axios before version 1.7.8. The same origin helper did not use a URL object and made a setAttribute call that scanners flag. The record gives no CVSS score and says some parties view the change as only a scanner warning. Upgrade to 1.7.8 or later.
What's affected
The record says axios before 1.7.8 is affected, in the file lib/helpers/isURLSameOrigin.js. That helper determines whether a request URL points to the same origin as the page. It did not use a URL object to work out the origin, and it contained a setAttribute('href', href) call that some static analysis tools flag.
The fix is in axios 1.7.8, released on 25 November 2024. The release notes list it as: use URL API instead of DOM to fix a potential vulnerability warning, pull request 6714. The record also carries a note that some parties feel the change only addresses a warning message from a SAST tool, and does not fix a vulnerability. The base score in the record is 0.0, severity none.
The code runs in browser builds. Server side use of axios in Node does not use the browser helper in the same way, so scanners may flag server projects that never execute that code.
How to check if you're exposed
List every axios version in your project, including transitive ones, since many packages depend on it:
npm ls axios
npm why axios
yarn why axios
pnpm why axios
Any version below 1.7.8 is in the range of the record. If you scan your lockfile with a tool that flags this CVE, find out whether the flagged copy ships to browsers. A copy that is only used in a Node service or in tests does not run the helper that changed.
For front end bundles, look at your build output for the axios version string, or check your bundle analyzer report for the package.
What to do now
- Run npm ls axios (or the equivalent for your tool) in each project, and note versions below 1.7.8.
- Upgrade axios to 1.7.8 or later, for example with npm install axios@^1.7.8, then rebuild and retest.
- For transitive copies, use your package manager's overrides or resolutions to force a fixed version, or update the parent package.
- Decide how to handle the scanner alert. If you accept the dispute, record that decision and the reason, so the finding does not come back every week.
- Do not skip the upgrade only because the entry is disputed. The change is small and the release includes other fixes.
- Keep your lockfile in review so version drift gets noticed.
Why it matters
This entry is a good lesson in triage. It maps to CWE-346, origin validation error, because the helper's job is to decide whether a URL has the same origin. Same origin checks matter in the browser, since they decide whether credentials and tokens such as XSRF headers are attached to a request. Building the origin through a DOM element and parsing the result is an older pattern. The URL API is the cleaner approach.
But the maintainers' own discussion on the original issue started from a scanner report asking about the setAttribute call, and the maintainer's first reaction was that it looked like a false positive. The record carries the dispute in its own note. The scores reflect that, with no impact rated in the vector.
The right response is neither panic nor dismissal. Upgrade, since the cost is low, and record why you rated the finding as low risk. The KEV flag in the record is false. A dependency scan that also shows whether the code is reachable helps you tell these cases apart.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-57965 a real vulnerability?
It is disputed. The record notes that some parties feel the change only addresses a SAST warning. The record gives no impact in the vector.
What should I do if my scanner flags it?
Upgrade axios to 1.7.8 or later where you can. If you cannot, document why the finding is low risk for your use.
Sources
Last reviewed: 19 October 2026.
