What’s Vulnerable › Vulnerabilities

CVE-2026-25639: Axios affected by Denial of Service via __proto__ Key in mergeConfig

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-09 · updated 2026-09-10
• Weakness: CWE-754

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Affected products

• axios: before 0.30.3; from 1.0.0 before 1.13.5 — fixed in 0.30.3, 1.13.5
• Npm Axios: from 1.0.0 before 1.13.5; before 0.30.3 — fixed in 1.13.5, 0.30.3

How to fix

Upgrade to a fixed version: axios 0.30.3, 1.13.5; Npm Axios 1.13.5, 0.30.3. Check the vendor advisory for mitigations.

References

• https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
• https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
• https://github.com/axios/axios/pull/7369
• https://github.com/axios/axios/pull/7388
• https://github.com/axios/axios/releases/tag/v0.30.3
• https://github.com/axios/axios/releases/tag/v1.13.5
• https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/errata/RHSA-2026:11414
• https://access.redhat.com/errata/RHSA-2026:13542
• https://access.redhat.com/errata/RHSA-2026:13548
• https://access.redhat.com/errata/RHSA-2026:19712

Get alerted when CVE-2026-25639 or the next vulnerability affects your stack