CVE-2026-25639
Analyzed Analyzed - Analysis Complete
TypeError Crash in Axios mergeConfig Causes Denial of Service

Publication date: 2026-02-09

Last updated on: 2026-05-21

Assigner: GitHub, Inc.

Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-09
Last Modified
2026-05-21
Generated
2026-06-16
AI Q&A
2026-02-09
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25639
EUVD
EUVD-2026-6850
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
axios axios to 0.30.3 (exc)
axios axios From 1.0.0 (inc) to 1.13.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Axios HTTP client before version 1.13.5. The mergeConfig function crashes with a TypeError when it processes configuration objects that contain __proto__ as an own property. An attacker can exploit this by providing a malicious configuration object, for example one created via JSON.parse(), which causes the application to crash completely, resulting in a denial of service.

Impact Analysis

The main impact of this vulnerability is a complete denial of service. An attacker can cause the Axios client to crash by sending a specially crafted configuration object, which disrupts the normal operation of applications relying on Axios for HTTP requests.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade the axios package to version 1.13.5 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart