CVE-2026-21697
Unknown Unknown - Not Provided
Race Condition in axios4go HTTP Client Causes Data Exposure

Publication date: 2026-01-07

Last updated on: 2026-03-09

Assigner: GitHub, Inc.

Description
axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-07
Last Modified
2026-03-09
Generated
2026-06-16
AI Q&A
2026-01-08
EPSS Evaluated
2026-06-14
NVD
CVE-2026-21697
EUVD
EUVD-2026-1381
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
rezmoss axios4go to 0.6.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the axios4go Go HTTP client library prior to version 0.6.4. The global default HTTP client configuration is modified concurrently without proper synchronization during request execution. Specifically, the shared http.Client's Transport, Timeout, and CheckRedirect properties are mutated while multiple requests run concurrently, which can cause unexpected behavior or security issues.

Impact Analysis

The vulnerability can impact applications that use axios4go with concurrent requests, especially if different requests use different proxy configurations or handle sensitive data such as authentication credentials, tokens, or API keys. The race condition may lead to incorrect or unintended sharing of HTTP client settings between requests, potentially exposing sensitive information or causing request failures.

Mitigation Strategies

Upgrade axios4go to version 0.6.4 or later, as this version fixes the race condition vulnerability in the shared HTTP client configuration.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart