Dark Mode

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

chore(deps): update dependency axios to v1.13.5 [security]#323

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-axios-vulnerability
Open

chore(deps): update dependency axios to v1.13.5 [security]#323
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-axios-vulnerability

Conversation

Copy link
Contributor

renovate bot commented Feb 11, 2026 *
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
axios (source) 1.8.4 - 1.13.5

GitHub Vulnerability Alerts

CVE-2026-25639

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
const merge = mergeMap[prop] || mergeDeepProperties;
const configValue = merge(config1[prop], config2[prop], prop);
(utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

  1. JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
  2. Object.keys() includes '__proto__' in the iteration
  3. mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
  4. The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
  5. Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

  • Axios._request() at lib/core/Axios.js:75
  • Axios.getUri() at lib/core/Axios.js:201
  • All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

  1. Clone axios repository or npm install axios
  2. Create file poc.mjs with the code above
  3. Run: node poc.mjs
  4. Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test Config Result
Normal config {"timeout": 5000} SUCCESS
Malicious config JSON.parse('{"__proto__": {"x": 1}}') CRASH
Nested object {"headers": {"X-Test": "value"}} SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

  • Node.js servers using axios for HTTP requests
  • Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Release Notes

axios/axios (axios)

v1.13.5

Compare Source

Release 1.13.5

Highlights
  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR # 7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR # 7368)
Changes
Security
  • Fix Denial of Service via __proto__ key in mergeConfig. (PR # 7369)
Fixes
  • Fix/5657. (PR # 7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR # 7368)
Features / Improvements
  • Add input validation to isAbsoluteURL. (PR # 7326)
  • Refactor: bump minor package versions. (PR # 7356)
Documentation
  • Clarify object-check comment. (PR # 7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR # 7371)
CI / Maintenance
  • Chore: fix issues with YAML. (PR # 7355)
  • CI: update workflow YAMLs. (PR # 7372)
  • CI: fix run condition. (PR # 7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR # 7360)
  • Chore(release): prepare release 1.13.5. (PR # 7379)
New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Compare Source

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes
  • fix: issues with version 1.13.3 (# 7352) (ee90dfc)
    • Fixed issues discovered in v1.13.3 release
    • Cleaned up interceptor test files
    • Improved workflow configurations
Infrastructure & CI/CD

  • refactor: ci and build (# 7340) (8ff6c19)

    • Major refactoring of CI/CD workflows
    • Consolidated workflow files for better maintainability
    • Added mise configuration for the development environment
    • Improved sponsor block update automation
    • Enhanced issue and PR templates
    • Added automatic release notes generation
    • Implemented workflow cancellation for concurrent runs

  • chore: codegen and some updates to workflows (76cf77b)

    • Code generation improvements
    • Workflow optimisations

Migration Notes

Breaking Changes

None in this release.

Deprecations

None in this release.

Contributors

Thank you to all contributors who made this release possible! Special thanks to:

v1.13.3

Compare Source

Bug Fixes
  • http2: Use port 443 for HTTPS connections by default. (# 7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (# 6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (# 5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (# 5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (# 7253) (# 7257) (7d19335)
  • turn AxiosError into a native error (# 5394) (# 5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (# 5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (# 7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (# 6314) (6ef867e)
Features
Reverts
Contributors to this release

v1.13.2

Compare Source

Bug Fixes
  • http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (# 7206) (8d37233)
  • http: use default export for http2 module to support stubs; (# 7196) (0588880)
Performance Improvements
Contributors to this release

v1.13.1

Compare Source

Bug Fixes
  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (# 7193) (bcd5581)
Contributors to this release

v1.13.0

Compare Source

Bug Fixes
Features
Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes
  • fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (# 7030) (cf78825)
Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes
Contributors to this release

v1.12.2

Compare Source

Bug Fixes
  • fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (# 7030) (cf78825)
Contributors to this release

v1.12.1

Compare Source

Bug Fixes
Contributors to this release

v1.12.0

Compare Source

Bug Fixes
Features
  • adapter: surface low-level network error details; attach original error via cause (# 6982) (78b290c)
  • fetch: add fetch, Request, Response env config variables for the adapter; (# 7003) (c959ff2)
  • support reviver on JSON.parse (# 5926) (2a97634), closes # 5924
  • types: extend AxiosResponse interface to include custom headers type (# 6782) (7960d34)
Contributors to this release

v1.11.0

Compare Source

Bug Fixes
  • form-data npm pakcage (# 6970) (e72c193)
  • prevent RangeError when using large Buffers (# 6961) (a2214ca)
  • types: resolve type discrepancies between ESM and CJS TypeScript declaration files (# 6956) (8517aa1)
Contributors to this release

v1.10.0

Compare Source

Bug Fixes
  • adapter: pass fetchOptions to fetch function (# 6883) (0f50af8)
  • form-data: convert boolean values to strings in FormData serialization (# 6917) (5064b10)
  • package: add module entry point for React Native; (# 6933) (3d343b8)
Features
Contributors to this release

v1.9.0

Compare Source

Bug Fixes
  • core: fix the Axios constructor implementation to treat the config argument as optional; (# 6881) (6c5d4cd)
  • fetch: fixed ERR_NETWORK mapping for Safari browsers; (# 6767) (dfe8411)
  • headers: allow iterable objects to be a data source for the set method; (# 6873) (1b1f9cc)
  • headers: fix getSetCookie by using 'get' method for caseless access; (# 6874) (d4f7df4)
  • headers: fixed support for setting multiple header values from an iterated source; (# 6885) (f7a3b5e)
  • http: send minimal end multipart boundary (# 6661) (987d2e2)
  • types: fix autocomplete for adapter config (# 6855) (e61a893)
Features
  • AxiosHeaders: add getSetCookie method to retrieve set-cookie headers values (# 5707) (80ea756)
Contributors to this release

1.8.4 (2025-03-19)

Bug Fixes
  • buildFullPath: handle allowAbsoluteUrls: false without baseURL (# 6833) (f10c2e0)
Contributors to this release

1.8.3 (2025-03-10)

Bug Fixes
  • add missing type for allowAbsoluteUrls (# 6818) (10fa70e)
  • xhr/fetch: pass allowAbsoluteUrls to buildFullPath in xhr and fetch adapters (# 6814) (ec159e5)
Contributors to this release

1.8.2 (2025-03-07)

Bug Fixes
  • http-adapter: add allowAbsoluteUrls to path building (# 6810) (fb8eec2)
Contributors to this release

1.8.1 (2025-02-26)

Bug Fixes
  • utils: move generateString to platform utils to avoid importing crypto module into client builds; (# 6789) (36a5a62)
Contributors to this release

Configuration

Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot requested review from buberdds and lubej as code owners February 11, 2026 17:57
renovate bot changed the title chore(deps): update dependency axios to v1.13.5 [security] chore(deps): update dependency axios to v1.13.5 [security] - autoclosed Feb 18, 2026
renovate bot closed this Feb 18, 2026
renovate bot deleted the renovate/npm-axios-vulnerability branch February 18, 2026 22:54
renovate bot changed the title chore(deps): update dependency axios to v1.13.5 [security] - autoclosed chore(deps): update dependency axios to v1.13.5 [security] Feb 20, 2026
renovate bot reopened this Feb 20, 2026
renovate bot force-pushed the renovate/npm-axios-vulnerability branch 2 times, most recently from f5ee44f to 9bd618f Compare February 20, 2026 15:33
renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 9bd618f to 2918aa3 Compare March 5, 2026 20:13
renovate bot force-pushed the renovate/npm-axios-vulnerability branch from 2918aa3 to b2e2f48 Compare March 13, 2026 14:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

buberdds Awaiting requested review from buberdds buberdds is a code owner

lubej Awaiting requested review from lubej lubej is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants