CVE-2026-25639: Axios denial of service in mergeConfig

CVE-2026-25639 · Severity: high · CVSS 7.5 · Published 2026-02-09

Axios is an HTTP client library widely used in Node.js applications. A denial-of-service vulnerability exists in the configuration merging logic that crashes the application when processing JSON objects containing __proto__ as a key. An attacker can trigger a complete application outage by providing a specially crafted JSON payload that gets passed through axios configuration methods, affecting any backend service that accepts and parses user-supplied JSON.

Technologies: Axios. Vendors: Axios.

Quick answers

Is CVE-2026-25639 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25639 being exploited in the wild.
How severe is CVE-2026-25639?
High severity, with a CVSS score of 7.5, published 9 February 2026.
Which products and versions are affected?
Axios < 0.30.3, < 1.13.5, 1.0.0 to 1.13.4 and 0.0.0 to 0.30.2.
Is there a fix for CVE-2026-25639?
A patch was published on 2026-02-04: Fix merged for v1.x branch in PR #7369 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25639 attacked?
It is attacked over the network.
Am I affected by CVE-2026-25639?
Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service (not prototype pollution) in lib/core/mergeConfig.js that occurs when JSON.parse() creates an object with __proto__ as an enumerable own property. When mergeConfig iterates through Object.keys(), it encounters __proto__ and attempts to retrieve mergeMap['__proto__'], which through prototype chain lookup returns Object.prototype (a truthy object). The code then tries to invoke this as a function—Object.prototype()—resulting in "TypeError: merge is not a function". The mergeConfig function is called by all HTTP request methods (get, post, etc.) and getUri(), making any application that passes user-controlled JSON to axios configuration vulnerable to immediate crash. Patches are available in axios v1.13.5 and v0.30.3, which filter dangerous keys (__proto__, constructor, prototype) and use own-property checks when selecting merge strategies.

Affected products

  • Axios axios 1.0.0 to 1.13.4 and 0.0.0 to 0.30.2

Identifiers

  • CVE-2026-25639
  • GHSA-43fc-jf86-j433

Timeline

  • 2026-02-09: disclosed: Advisory published
  • 2026-02-04: patched: Fix merged for v1.x branch in PR #7369
  • 2026-02-11: patched: Fix backported to v0.x branch in PR #7388

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.