Executive brief
Axios is an HTTP client library widely used in Node.js applications. A denial-of-service vulnerability exists in the configuration merging logic that crashes the application when processing JSON objects containing __proto__ as a key. An attacker can trigger a complete application outage by providing a specially crafted JSON payload that gets passed through axios configuration methods, affecting any backend service that accepts and parses user-supplied JSON.
Technical details
The vulnerability is a denial-of-service (not prototype pollution) in lib/core/mergeConfig.js that occurs when JSON.parse() creates an object with __proto__ as an enumerable own property. When mergeConfig iterates through Object.keys(), it encounters __proto__ and attempts to retrieve mergeMap['__proto__'], which through prototype chain lookup returns Object.prototype (a truthy object). The code then tries to invoke this as a function—Object.prototype()—resulting in "TypeError: merge is not a function". The mergeConfig function is called by all HTTP request methods (get, post, etc.) and getUri(), making any application that passes user-controlled JSON to axios configuration vulnerable to immediate crash. Patches are available in axios v1.13.5 and v0.30.3, which filter dangerous keys (__proto__, constructor, prototype) and use own-property checks when selecting merge strategies.
Affected products
- Axios axios 1.0.0 to 1.13.4 and 0.0.0 to 0.30.2
Timeline
- 2026-02-09: disclosed: Advisory published
- 2026-02-04: patched: Fix merged for v1.x branch in PR #7369
- 2026-02-11: patched: Fix backported to v0.x branch in PR #7388
References
- https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
- https://github.com/axios/axios/pull/7369
- https://github.com/axios/axios/pull/7388
- https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
- https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
- https://github.com/axios/axios