Vulnerability in Axios
CVE-2026-25639
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.018 (77.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 77.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.027 · newest: 0.018 · change: -0.009
Affected products
- Axios — versions >= 1.0.0, < 1.13.5, < 0.30.3
Weakness classification (CWE)
References
- github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433 (Exploit, Vendor Advisory)
- github.com/axios/axios/pull/7369 (Issue Tracking)
- github.com/axios/axios/pull/7388 (Issue Tracking)
- github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57 (Patch)
- github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e (Patch)
- github.com/axios/axios/releases/tag/v0.30.3 (Release Notes)
- github.com/axios/axios/releases/tag/v1.13.5 (Product, Release Notes)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-25639?
- CVE-2026-25639 is a high-severity vulnerability in Axios, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 7.5/10. Published 2026-02-09.
- How severe is CVE-2026-25639?
- High severity. CVSS v3 base score is 7.5 out of 10.