Axios Vulnerability Trigger DoS
A serious security flaw has been discovered in Axios, one of the most popular HTTP client libraries for Node.js, allowing attackers to crash servers and trigger denial-of-service (DoS) attacks.
The vulnerability, tracked as CVE-2026-25639, affects all versions up to and including 1.13.4.
The vulnerability exploits Axios’s mergeConfig function, which processes configuration objects before making HTTP requests.
When an attacker provides a specially crafted JSON object containing __proto__ as a property, the library attempts to treat JavaScript’s Object.prototype as a callable function, resulting in an immediate crash.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-25639 |
| Vulnerability Title | Denial of Service via proto Key in mergeConfig |
| Package | axios (npm) |
| Affected Versions | <= 1.13.4 |
| Patched Versions | 1.13.5 |
| Severity | High |
| CVSS Score | 7.5 |
The attack is remarkably simple. An attacker only needs to send a malicious payload like {"__proto__": {"x": 1}} through any endpoint that accepts JSON input and passes it to Axios configuration methods.
The vulnerability exists in the configuration merging logic at lines 98-101 of lib/core/mergeConfig.js, where the code fails to properly validate property names before processing them.
This isn’t a typical prototype pollution attack where malicious code gradually corrupts application behavior.
Instead, the server crashes immediately upon processing the malicious configuration, making it a powerful DoS weapon.
Any Node.js application that accepts user-controlled JSON and passes it to Axios methods like get(), post(), or other HTTP shortcuts becomes vulnerable.
The impact extends across numerous applications since Axios is widely used in backend services for making API calls.
Attackers can exploit this remotely without authentication, requiring minimal technical sophistication to execute successful attacks.
The Common Vulnerability Scoring System (CVSS) rates this vulnerability as High severity with a score of 7.5 out of 10.
The attack vector is network-based with low complexity, requiring no privileges or user interaction.
While it doesn’t compromise confidentiality or integrity, it completely disrupts availability by crashing the application.
Security researcher hackerman70000 discovered and reported the vulnerability. The Axios team responded by releasing version 1.13.5, which patches the flaw by implementing proper checks for unusual property names in configuration objects.
Developers using Axios must upgrade to version 1.13.5 immediately.
Organizations should audit their codebases to identify any instances where user input flows into Axios configuration parameters and ensure updated versions are deployed across all production environments.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…