CVE Feed

    Dashboard / CVE / CVE-2026-25639

    CVE-2026-25639

    Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

    Published:Feb 9, 2026
    Last Modified:Apr 17, 2026
    EPS:Feb 9, 2026
    EPSS Score:0.00051
    CVSS Score:7.5

    Affected Products

    Vendor
    Axios
    Product
    Axios

    Exploits

    https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-67321 (CVSS 6.9) — axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFor…
    CVE-2026-67318 (CVSS 6.3) — axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed …
    CVE-2026-67319 (CVSS 6.3) — axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option object…
    CVE-2026-67312 (CVSS 6.3) — axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDa…
    CVE-2026-67315 (CVSS 6.9) — axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address i…
    CVE-2026-67316 (CVSS 6.3) — axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.p…
    CVE-2026-67320 (CVSS 8.3) — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. …
    CVE-2026-67313 (CVSS 6.3) — axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData fiel…
    CVE-2026-67314 (CVSS 6.3) — axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handl…
    CVE-2026-67317 (CVSS 6.3) — axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t…

    References

    https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
    https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
    https://github.com/axios/axios/pull/7369
    https://github.com/axios/axios/pull/7388
    https://github.com/axios/axios/releases/tag/v0.30.3
    https://github.com/axios/axios/releases/tag/v1.13.5
    https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
    https://access.redhat.com/errata/RHSA-2026:10184
    https://access.redhat.com/errata/RHSA-2026:11414
    https://access.redhat.com/errata/RHSA-2026:13542
    https://access.redhat.com/errata/RHSA-2026:13548
    https://access.redhat.com/errata/RHSA-2026:19712
    https://access.redhat.com/errata/RHSA-2026:25041
    https://access.redhat.com/errata/RHSA-2026:2694
    https://access.redhat.com/errata/RHSA-2026:3087
    https://access.redhat.com/errata/RHSA-2026:3105
    https://access.redhat.com/errata/RHSA-2026:3106
    https://access.redhat.com/errata/RHSA-2026:3107
    https://access.redhat.com/errata/RHSA-2026:3109
    https://access.redhat.com/errata/RHSA-2026:36882
    https://access.redhat.com/errata/RHSA-2026:41064
    https://access.redhat.com/errata/RHSA-2026:4942
    https://access.redhat.com/errata/RHSA-2026:5142
    https://access.redhat.com/errata/RHSA-2026:5168
    https://access.redhat.com/errata/RHSA-2026:5174
    https://access.redhat.com/errata/RHSA-2026:5633
    https://access.redhat.com/errata/RHSA-2026:5636
    https://access.redhat.com/errata/RHSA-2026:5665
    https://access.redhat.com/errata/RHSA-2026:5807
    https://access.redhat.com/errata/RHSA-2026:6170
    https://access.redhat.com/errata/RHSA-2026:6174
    https://access.redhat.com/errata/RHSA-2026:6192
    https://access.redhat.com/errata/RHSA-2026:6277
    https://access.redhat.com/errata/RHSA-2026:6308
    https://access.redhat.com/errata/RHSA-2026:6309
    https://access.redhat.com/errata/RHSA-2026:6428
    https://access.redhat.com/errata/RHSA-2026:6497
    https://access.redhat.com/errata/RHSA-2026:6567
    https://access.redhat.com/errata/RHSA-2026:6568
    https://access.redhat.com/errata/RHSA-2026:6802
    https://access.redhat.com/errata/RHSA-2026:7249
    https://access.redhat.com/errata/RHSA-2026:8218
    https://access.redhat.com/errata/RHSA-2026:8229
    https://access.redhat.com/errata/RHSA-2026:8499
    https://access.redhat.com/errata/RHSA-2026:8500
    https://access.redhat.com/errata/RHSA-2026:8501
    https://access.redhat.com/errata/RHSA-2026:9848
    https://access.redhat.com/security/cve/CVE-2026-25639
    https://bugzilla.redhat.com/show_bug.cgi?id=2438237
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25639.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High