TypeError Vulnerability in Axios HTTP Client Affects Browser and Node.js
CVE-2026-25639
7.5HIGH
What is CVE-2026-25639?
A vulnerability in the Axios HTTP client prior to version 1.13.5 can be exploited through malicious configuration objects that include 'proto' as an own property. This leads to a TypeError in the mergeConfig function, resulting in a denial of service. Attackers can achieve this by leveraging JSON.parse() to create harmful configuration objects. The issue has been resolved in version 1.13.5, and users are advised to upgrade to ensure application security.
Affected Version(s)
axios >= 1.0.0, < 1.13.5 < 1.0.0, 1.13.5
axios < 0.30.3 < 0.30.3