CVE-2026-21697

Unknown Unknown - Not Provided

Race Condition in axios4go HTTP Client Causes Data Exposure

Publication date: 2026-01-07

Last updated on: 2026-03-09

Assigner: GitHub, Inc.

Description

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-07

Last Modified

2026-03-09

Generated

2026-07-06

AI Q&A

2026-01-08

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21697

EUVD

EUVD-2026-1381

Affected Vendors & Products

Vendor	Product	Version / Range
rezmoss	axios4go	to 0.6.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the axios4go Go HTTP client library prior to version 0.6.4. The global default HTTP client configuration is modified concurrently without proper synchronization during request execution. Specifically, the shared http.Client's Transport, Timeout, and CheckRedirect properties are mutated while multiple requests run concurrently, which can cause unexpected behavior or security issues.

Impact Analysis

The vulnerability can impact applications that use axios4go with concurrent requests, especially if different requests use different proxy configurations or handle sensitive data such as authentication credentials, tokens, or API keys. The race condition may lead to incorrect or unintended sharing of HTTP client settings between requests, potentially exposing sensitive information or causing request failures.

Mitigation Strategies

Upgrade axios4go to version 0.6.4 or later, as this version fixes the race condition vulnerability in the shared HTTP client configuration.

Hi! I’m here to help you understand CVE-2026-21697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70