7.5
High
CVE-2026-25639 Axios is a promise based HTTP client for the browser and Node.js
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| axios 1.0 | 1.0.0 → < 1.13.5 | 1.13.5 |
| axios 0.30 | earliest → < 0.30.3 | 0.30.3 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Network Observability (NETOBSERV) 1.11.2 1774431617 | earliest → < 1774431617 | 1774431617 |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 1773259174 | earliest → < 1773259174 | 1773259174 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1775116130 | earliest → < 1775116130 | 1775116130 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126 | earliest → < 1776927126 | 1776927126 |
| Red Hat Ansible Automation Platform 2.5 1774446874 | earliest → < 1774446874 | 1774446874 |
| Red Hat Ansible Automation Platform 2.6 1774363040 | earliest → < 1774363040 | 1774363040 |
Show the 68 other branches Hide the 68 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Developer Hub 1.8 1774545605 | earliest → < 1774545605 | 1774545605 |
| Red Hat Developer Hub 1.9 1775140647 | earliest → < 1775140647 | 1775140647 |
| Red Hat Discovery 2 1770913709 | earliest → < 1770913709 | 1770913709 |
| Red Hat Migration Toolkit 1.8 1780590717 | earliest → < 1780590717 | 1780590717 |
| Red Hat OpenShift AI 2.16 1774282136 | earliest → < 1774282136 | 1774282136 |
| Red Hat OpenShift AI 2.25 1776742141 | earliest → < 1776742141 | 1776742141 |
| Red Hat OpenShift AI 3.3 1778666987 | earliest → < 1778666987 | 1778666987 |
| Red Hat OpenShift Container Platform 4.19 1775577192 | earliest → < 1775577192 | 1775577192 |
| Red Hat OpenShift Container Platform 4.20 1773746857 | earliest → < 1773746857 | 1773746857 |
| Red Hat OpenShift Container Platform 4.21 1773849532 | earliest → < 1773849532 | 1773849532 |
| Red Hat OpenShift Dev Spaces 3.27 1774227265 | earliest → < 1774227265 | 1774227265 |
| Red Hat OpenShift Pipelines 1.21 1774871390 | earliest → < 1774871390 | 1774871390 |
| Red Hat OpenShift Service Mesh 2.6 1771230055 | earliest → < 1771230055 | 1771230055 |
| Red Hat OpenShift Service Mesh 3.0 1771373071 | earliest → < 1771373071 | 1771373071 |
| Red Hat OpenShift Service Mesh 3.1 1771385160 | earliest → < 1771385160 | 1771385160 |
| Red Hat OpenShift Service Mesh 3.2 1771385315 | earliest → < 1771385315 | 1771385315 |
| Red Hat Quay 3.12 1773771962 | earliest → < 1773771962 | 1773771962 |
| Red Hat Quay 3.15 1775169219 | earliest → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1775169226 | earliest → < 1775169226 | 1775169226 |
| Red Hat Quay 3.16 1775069491 | earliest → < 1775069491 | 1775069491 |
| Red Hat Quay 3.1 1773971077 | earliest → < 1773971077 | 1773971077 |
| Red Hat Quay 3.9 1773936323 | earliest → < 1773936323 | 1773936323 |
| Red Hat Satellite 6.18 1776269713 | earliest → < 1776269713 | 1776269713 |
| Red Hat Trusted Artifact Signer 1.3 1771324807 | earliest → < 1771324807 | 1771324807 |
| multicluster engine for Kubernetes 2.10 1777128790 | earliest → < 1777128790 | 1777128790 |
| multicluster engine for Kubernetes 2.6 1776223790 | earliest → < 1776223790 | 1776223790 |
| multicluster engine for Kubernetes 2.7 1773100128 | earliest → < 1773100128 | 1773100128 |
| multicluster engine for Kubernetes 2.8 1775116156 | earliest → < 1775116156 | 1775116156 |
| multicluster engine for Kubernetes 2.9 1777301444 | earliest → < 1777301444 | 1777301444 |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Trusted Profile Analyzer | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Advanced Cluster Security 4 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat Build of Kueue | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| Red Hat Quay 3.10 1773971077 | earliest → < 1773971077 | 1773971077 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 | earliest → < 1783451729 | 1783451729 |
| Red Hat OpenShift Service Mesh 3 1771373071 | earliest → < 1771373071 | 1771373071 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 1783350952 | earliest → < 1783350952 | 1783350952 |
| multicluster engine for Kubernetes 2.1 1777128790 | earliest → < 1777128790 | 1777128790 |
| Red Hat Migration Toolkit for Containers 1.8 1780590717 | earliest → < 1780590717 | 1780590717 |
| Red Hat OpenShift Container Platform 4.2 1773746857 | earliest → < 1773746857 | 1773746857 |
| multicluster engine for Kubernetes 2.9.0 1777301444 | earliest → < 1777301444 | 1777301444 |
| Network Observability (NETOBSERV) 1.11.1 1774431617 | earliest → < 1774431617 | 1774431617 |
| Network Observability (NETOBSERV) 1.11.0 1774431617 | earliest → < 1774431617 | 1774431617 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of axios
The 53 CVEs of axios →
CVE-2026-101899
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js
8.3
High
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js
7.0
High