CVE-2026-25639: Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
(updated )
The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.
References
- github.com/advisories/GHSA-43fc-jf86-j433
- github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
- github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
- github.com/axios/axios/pull/7369
- github.com/axios/axios/pull/7388
- github.com/axios/axios/releases/tag/v0.30.3
- github.com/axios/axios/releases/tag/v1.13.5
- github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
- nvd.nist.gov/vuln/detail/CVE-2026-25639
Code Behaviors & Features
Detect and mitigate CVE-2026-25639 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →