Axios 0.x in 2026: Supported, but Only on the Newest Release
Axios 0.x is not end of life. The project's security policy lists 0.x.x as supported, next to 1.x.x, and the maintainers are still shipping 0.x releases: 0.34.0 was published to npm on September 16, 2026, three weeks after 1.20.0 on August 26, 2026. What the policy does not say, and the advisories do, is where a 0.x fix lands. It lands in the next 0.x release, not in the minor version your code is pinned to.
What Axios's 2026 advisories show
Axios publishes its advisories on GitHub with an affected range and a patched version for each release line. For every 2026 advisory that reaches into 0.x, the patched 0.x version is the newest 0.x release at the time. None names a patched build on an older 0.x minor.
| 0.x release that carried the fixes | Published to npm | Examples of advisories fixed there |
|---|---|---|
| 0.31.1 | 2026-04-19 | CVE-2026-42043 (NO_PROXY patch bypass), CVE-2026-42041 (authentication bypass via a prototype-pollution gadget), CVE-2026-44495 |
| 0.32.0 | 2026-05-04 | CVE-2026-44492 (NO_PROXY bypass with IPv4-mapped IPv6), CVE-2026-44486 and CVE-2026-44487 (Proxy-Authorization leaks on redirect) |
| 0.33.0 | 2026-06-14 | CVE-2026-69124 (inherited proxy after interceptor config cloning), CVE-2026-69123, CVE-2026-68944 |
| 0.34.0 | 2026-09-16 | GHSA-x97p-jq2g-jp4f (prototype-pollution gadget in toFormData options, affected from 0.28.0), GHSA-9fr6-4gfg-395g (affected from 0.27.2) |
The affected ranges are why the pinned-minor question matters. The 0.34.0 advisories reach back to 0.27.2 and 0.28.0, and CVE-2026-69123 is listed as affecting everything from 0.8.0. A 0.27 install falls inside the GHSA-9fr6-4gfg-395g and CVE-2026-69123 ranges and outside every patched version Axios names.
One 0.x flaw with only a 1.x fix
Axios's advisory for CVE-2026-68942, excessive recursion in formDataToJSON that can cause a denial of service, gives the vulnerable range as 0.28.0 and later and the patched version as 1.18.0, with no 0.x release listed as patched. Read literally, the fix for that flaw is the move to 1.x. It is rated medium, and it is the one place in this year's advisories where staying current on 0.x is not enough.
Why so much code is still on 0.x
HeroDevs points to behaviour changes at 1.0 in error handling, header normalization and module resolution as the reason 0.x code does not always move across cleanly. Much of the 0.x in production is not a direct choice either: it arrives through an SDK, an agent or an internal tool that pinned a 0.x range and never re-released. The volume is large. npm's own counter recorded more than 86 million downloads of axios in the week of September 17 to 23, 2026, across all versions.
The commercial 0.x option
On September 25, 2026, HeroDevs announced Never-Ending Support (NES) for Axios, which it describes as a partnership with the Axios project covering the legacy 0.x line: SLA-backed security fixes for every CVSS severity, delivered as a drop-in npm replacement with no API changes, with a portion of the product funding the Axios project itself. HeroDevs lists 0.24.x, 0.27.x and 0.33.x among the supported versions. That is the route for code that cannot move to the newest 0.x or to 1.x on the timeline its scanners and auditors expect.
If that describes your stack, the form on this page reaches us, and we reply with the options that fit the versions you run.
What to do
- Find the minor, not the major. Run
npm ls axiosto see every copy in the tree, including the ones your dependencies pinned. "We're on 0.x" is not an answer; the answer is which 0.x. - On an older 0.x minor: move to 0.34.0 or later for this year's 0.x fixes, and plan the 1.x move for CVE-2026-68942.
- Pinned by a dependency: an npm
overridesentry can lift a transitive 0.x to the newest 0.x without waiting for the dependency to re-release. Test it, because 0.x minor releases do carry behavioural changes. - On 1.x: the same pattern holds. Fixes ship in the next 1.x release, so 1.20 is the line that carries this month's 1.x fixes.
- Inventory: the Axios page lists every tracked release line with its dates, and
curl https://api.endoflife.ai/v1/score/axios/0.27returns what we serve for a given line.
Frequently asked questions
Is Axios 0.x end of life?
No. Axios's security policy lists 0.x.x as supported alongside 1.x.x. In practice the maintainers fix 0.x by publishing a new 0.x release, not by backporting to older 0.x minors: the fixes in Axios's 2026 advisories landed in 0.31.1, 0.32.0, 0.33.0 and 0.34.0. A project pinned to an older 0.x minor, such as 0.27, gets those fixes only by moving to the newest 0.x release.
Is Axios 0.27 still getting security fixes?
Not on the 0.27 line itself. Axios's advisories list the patched versions as the newest 0.x release at the time, never a 0.27.x build, so the fix for a flaw that reaches back to 0.27 arrives in a later 0.x release. Staying on 0.27 means carrying every 0.x advisory published since.
Is there paid extended support for Axios 0.x?
Yes. HeroDevs announced Never-Ending Support for Axios on September 25, 2026, describing it as a partnership with the Axios project covering the legacy 0.x line, with SLA-backed security fixes delivered as a drop-in replacement and a portion of the revenue funding the project. HeroDevs lists 0.24.x, 0.27.x and 0.33.x among the versions it supports.
Sources
- Axios, SECURITY.md on the v1.x branch (github.com/axios/axios): supported versions.
- Axios, GitHub security advisories (github.com/axios/axios/security/advisories): affected ranges and patched versions for each advisory cited.
- npm registry (registry.npmjs.org/axios and api.npmjs.org/downloads): publication dates and weekly downloads.
- HeroDevs, "HeroDevs Launches Never-Ending Support (NES) for Axios", September 25, 2026, and its NES for Axios product page.
Related
- Axios lifecycle page — every tracked release line
- Extended support — how support after the maintainers stop works
- How we verify our dates