# CVE-2026-25639: Axios denial of service in mergeConfig

Source: https://junglewise.ai/threats/cve-2026-25639-axios-denial-of-service-in-mergeconfig  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25639 · Severity: high · CVSS 7.5 · Published 2026-02-09

Axios is an HTTP client library widely used in Node.js applications. A denial-of-service vulnerability exists in the configuration merging logic that crashes the application when processing JSON objects containing __proto__ as a key. An attacker can trigger a complete application outage by providing a specially crafted JSON payload that gets passed through axios configuration methods, affecting any backend service that accepts and parses user-supplied JSON.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios).

## Quick answers

**Is CVE-2026-25639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25639 being exploited in the wild.

**How severe is CVE-2026-25639?** High severity, with a CVSS score of 7.5, published 9 February 2026.

**Which products and versions are affected?** Axios < 0.30.3, < 1.13.5, 1.0.0 to 1.13.4 and 0.0.0 to 0.30.2.

**Is there a fix for CVE-2026-25639?** A patch was published on 2026-02-04: Fix merged for v1.x branch in PR #7369 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25639 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-25639?** Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service (not prototype pollution) in lib/core/mergeConfig.js that occurs when JSON.parse() creates an object with __proto__ as an enumerable own property. When mergeConfig iterates through Object.keys(), it encounters __proto__ and attempts to retrieve mergeMap['__proto__'], which through prototype chain lookup returns Object.prototype (a truthy object). The code then tries to invoke this as a function—Object.prototype()—resulting in "TypeError: merge is not a function". The mergeConfig function is called by all HTTP request methods (get, post, etc.) and getUri(), making any application that passes user-controlled JSON to axios configuration vulnerable to immediate crash. Patches are available in axios v1.13.5 and v0.30.3, which filter dangerous keys (__proto__, constructor, prototype) and use own-property checks when selecting merge strategies.

## Affected products

- Axios axios 1.0.0 to 1.13.4 and 0.0.0 to 0.30.2

## Identifiers

- CVE-2026-25639
- GHSA-43fc-jf86-j433

## Timeline

- 2026-02-09: disclosed: Advisory published
- 2026-02-04: patched: Fix merged for v1.x branch in PR #7369
- 2026-02-11: patched: Fix backported to v0.x branch in PR #7388

## References

- [https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433](https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433)
- [https://github.com/axios/axios/pull/7369](https://github.com/axios/axios/pull/7369)
- [https://github.com/axios/axios/pull/7388](https://github.com/axios/axios/pull/7388)
- [https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57](https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57)
- [https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e](https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e)
- [https://github.com/axios/axios](https://github.com/axios/axios)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)