What’s Vulnerable › Vulnerabilities

CVE-2026-21697: axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-07 · updated 2026-06-17
• Weakness: CWE-362

Description

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

Affected products

• rezmoss axios4go: before 0.6.4 — fixed in 0.6.4

How to fix

Upgrade to a fixed version: rezmoss axios4go 0.6.4. Check the vendor advisory for mitigations.

References

• https://github.com/rezmoss/axios4go/commit/b651604c64e66a115ab90cdab358b0181d74a842
• https://github.com/rezmoss/axios4go/releases/tag/v0.6.4
• https://github.com/rezmoss/axios4go/security/advisories/GHSA-cmj9-27wj-7x47

Get alerted when CVE-2026-21697 or the next vulnerability affects your stack