CVE-2026-25639
EUVD-2026-685009.02.2026, 21:15
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| axios | axios | 𝑥 < 0.30.3 |
| axios | axios | 1.0.0 ≤ 𝑥 < 1.13.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-754 - Improper Check for Unusual or Exceptional ConditionsThe software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
- CWE-1287 - Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
References