CVE-2026-25639

What it actually does

Axios versions prior to 0.30.3 and 1.13.5 can throw an unhandled TypeError in mergeConfig when a configuration object contains __proto__ as its own property, such as an object produced by JSON.parse(). If an application passes attacker-influenced JSON or request-derived data into axios configuration merging, the process or request handler can crash, causing denial of service. The issue does not directly provide confidentiality or integrity impact, code execution, or privilege escalation; the primary impact is availability loss.

Why it matters to the business

Applications that use vulnerable axios versions may become unavailable if they accept or construct axios request configuration from untrusted input. For Node.js services, a crash can interrupt API processing, background jobs, integrations, webhooks, or service-to-service calls that depend on axios. Browser applications may experience client-side failures or broken workflows. Although this is not listed in CISA KEV and no mature public exploitation is indicated, the CVSS availability impact is high and axios is a widely used HTTP client, so exposed services should be patched during normal-to-expedited dependency maintenance, especially where user-supplied JSON influences outbound request options.

How an attack unfolds

An attacker first identifies an application path where user-controlled data is parsed as JSON and then merged into or used as an axios request configuration object. They submit JSON containing an own __proto__ property. When the vulnerable application passes that object into axios and axios calls mergeConfig, axios mishandles the __proto__ property and throws a TypeError. If the application does not catch the exception or isolate the failing request, the request handler, worker, or Node.js process can terminate or enter a failure loop. Repeated requests can sustain service disruption until the vulnerable code path is patched, input is sanitized, or process supervision restores the service.

How to fix it

Upgrade axios to a fixed release: 0.30.3 or later on the 0.x line, or 1.13.5 or later on the 1.x line. For source-based consumers, include axios commit 29f75425f0c9f73021f5eedc869c176e30e05fe7 or a later commit containing the fix. Regenerate lockfiles and rebuild deployable artifacts so transitive and bundled copies are also updated. If immediate upgrade is not possible, prevent untrusted objects from being used as axios configuration; explicitly allowlist supported configuration keys, reject or remove __proto__, constructor, and prototype properties from parsed input, and wrap axios calls in exception handling so a single malformed request cannot crash the process. Use process supervision and rate limiting as compensating controls, but do not treat them as substitutes for upgrading.

How to confirm the fix worked

Confirm dependency inventories, package manifests, and lockfiles show axios 0.30.3 or later, 1.13.5 or later, or a source revision at or after commit 29f75425f0c9f73021f5eedc869c176e30e05fe7. Check both direct and transitive dependencies using package manager tooling such as npm ls axios, yarn why axios, pnpm why axios, or software composition analysis. Validate deployed artifacts rather than only source repositories, because bundled JavaScript or container images may retain an older axios copy. In a non-production test environment, exercise any endpoint that maps JSON into axios options with a benign payload containing an own __proto__ property and confirm the application rejects/sanitizes it or handles it without an uncaught TypeError or process restart.

Typical attack path

1. Find an application endpoint, webhook, job processor, or API feature that accepts JSON input and uses it to influence axios request configuration.
2. Send a crafted JSON payload containing an own __proto__ property.
3. Trigger application logic that parses the payload with JSON.parse() or equivalent and passes the resulting object into axios configuration merging.
4. Cause axios mergeConfig to throw a TypeError.
5. Repeat requests or trigger retries to keep the affected service, worker, or workflow unavailable.

How to detect it

Look for evidence of denial-of-service attempts or crashes associated with axios configuration merging. Useful log sources include application error logs, Node.js uncaught exception logs, process manager logs, container stdout/stderr, Kubernetes pod restart events, serverless invocation errors, API gateway or WAF logs, and HTTP request logs with captured bodies or parameter names. Search for TypeError stack traces referencing axios mergeConfig, repeated process restarts shortly after requests containing __proto__, and spikes in 5xx responses, worker exits, pod CrashLoopBackOff states, or failed jobs. If request bodies are logged or retained in WAF/API security telemetry, search for JSON keys named __proto__, especially near routes that trigger outbound HTTP calls. Because the vulnerability is a crash condition rather than persistence or code execution, durable host artifacts are unlikely; detection relies primarily on correlating malicious payloads with application exceptions and availability events.

• __proto__
• "__proto__"
• TypeError
• mergeConfig
• axios/lib/core/mergeConfig
• node_modules/axios/lib/core/mergeConfig
• node_modules/axios/dist
• uncaughtException
• UnhandledPromiseRejection
• CrashLoopBackOff
• npm ls axios
• axios@0.30.2
• axios@1.13.4

What your security team should do

• Inventory all applications, containers, serverless functions, front-end bundles, and build artifacts that include axios.
• Prioritize patching internet-facing Node.js services and webhook/API processors where user-supplied JSON can influence outbound HTTP request configuration.
• Upgrade axios to 0.30.3, 1.13.5, or later and redeploy rebuilt artifacts with refreshed lockfiles.
• Add input validation or configuration allowlisting so untrusted request bodies cannot be passed directly into axios configuration objects.
• Search logs for TypeError crashes around axios mergeConfig and correlate them with requests containing __proto__ in JSON bodies or parameters.
• Ensure Node.js services have centralized error handling, worker isolation, and process supervision to reduce the blast radius of malformed input.
• Add dependency scanning rules to prevent reintroduction of axios versions older than 0.30.3 or 1.13.5.