Not scored
CVE-2026-25639
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
2.8%probability of exploitation in the next 30 days
Higher than 86% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
Coverage 1 article · 1 outlet
- HTTP Down: High-Severity Axios Flaw (CVSS 7.5) Crashes Node.js ServersSecurityOnline · first in our coverage