vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-25639

Axios affected by Denial of Service via __proto__ Key in mergeConfig

HIGH
7.5
CVSS Score
Published: February 9, 2026 at 08:11 PM UTC
Updated: September 10, 2026 at 01:17 PM UTC
15 products affected across 2 vendorsAxiosOpenShift Container PlatformFuse

Using axios by axios?

Get instant alerts when new vulnerabilities affect axios - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 3%
SSVC
No known exploit

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in 1.13.5.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Axios· Axiosnpm
95%
v < 0.30.3v < 1.13.51.0.0 ≤ v < 1.13.5
Affected range stops below 0.30.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.13.5, so it looks safe — our inference, not a vendor statement
3SCALE API Management Platform· Red Hatrpm
60%
2
Ansible Automation Platform· Red Hatrpm
60%
2
Vendor states this is fixed in 0:2.6.7-1.el9ap (unaffected)
Vendor states this is fixed in 1774243862 (unaffected)
Vendor states this is fixed in 1774363040 (unaffected)
Vendor states this is fixed in 1774446874 (unaffected)
Vendor states this is fixed in 2 (unaffected)
Build of Apicurio Registry· Red Hatrpm
60%
2
Build of Podman Desktop· Red Hat
60%
All versions
Enterprise Linux AI· Red Hatrpm
60%
3
Fuse· Red Hatrpm
60%
7
Logging Subsystem for Red Hat OpenShift· Red Hatcontainer
60%
All versions
Migration Toolkit for Applications· Red Hatrpm
60%
8
OpenShift Container Platform· Red Hatcontainer
60%
4
Vendor states this is fixed in 1773746857 (unaffected)
Vendor states this is fixed in 1773849532 (unaffected)
Vendor states this is fixed in 1775577192 (unaffected)

References (51)

x_refsource_CONFIRMExploitVendor Advisory
Source: cverecord
https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
x_refsource_MISCPatch
Source: cverecord
https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
x_refsource_MISCProductRelease Notes
Source: cverecord
https://github.com/axios/axios/releases/tag/v1.13.5
x_refsource_MISCIssue Tracking
Source: cverecord
https://github.com/axios/axios/pull/7369
x_refsource_MISCIssue Tracking
Source: cverecord
https://github.com/axios/axios/pull/7388
x_refsource_MISCPatch
Source: cverecord
https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
x_refsource_MISCRelease Notes
Source: cverecord
https://github.com/axios/axios/releases/tag/v0.30.3
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10184

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-754CWE-1287

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card