CVE-2026-25639
Aliases:GHSA-43fc-jf86-j433DEBIAN-CVE-2026-25639UBUNTU-CVE-2026-25639CGA-29mj-2qp4-9w5wCGA-2hrq-6mj8-64pcCGA-2p26-4qxg-cw2wCGA-3gcc-gc8w-f634CGA-4jqw-rwrh-74c9CGA-5chr-r339-7vgqCGA-63hf-f968-46wgCGA-9x92-4wvr-572gCGA-c7fq-qwf5-cmvwCGA-f2g9-6549-wj36CGA-ffr8-h546-gp33CGA-fgjm-c7pj-g5mpCGA-frm6-893m-j665CGA-fwc4-wqh2-px2gCGA-fwpp-hr8c-mvw4CGA-gcwf-w462-qmmgCGA-h2jw-9jrj-wxvqCGA-h63f-7xch-35gcCGA-jfhh-jxrj-gqm3CGA-jw76-fh6q-g4m5CGA-m68p-3rxq-xf32CGA-p66j-9cx8-3p34CGA-272v-grqw-rgmrCGA-2945-mgx6-p8v8CGA-29w2-mmhg-vgc8CGA-2h3v-w57c-h5vvCGA-2hrh-49g3-j576CGA-2vhg-gp6j-g37cCGA-328j-cvr7-4r97CGA-34ff-8q8v-37v8CGA-3c4g-wh9v-7x27CGA-3c7m-84fc-3fqvCGA-3r8w-jxwq-9pjvCGA-3v42-38x5-fc2wCGA-44f3-qgpc-xwpxCGA-44v9-fgw5-j22rCGA-472q-j423-hvm9CGA-47f3-33fr-x7cjCGA-48j9-wj42-w8jrCGA-49xv-x46x-qfwfCGA-4x3g-h4cr-wc6vCGA-4x4x-7538-xvp3CGA-4xfw-cwhw-7whxCGA-55jg-394q-7vp9CGA-57qv-wj49-qhhjCGA-589g-3hmj-v5m7CGA-58mc-ggg2-pq89CGA-5956-4w45-phm8CGA-5f2v-x8vg-j3wwCGA-5h36-79f8-qv6mCGA-5r7c-p84c-6ff8CGA-5rp4-pg8r-5x25CGA-5xrg-rf89-93gjCGA-625w-wr9h-cprwCGA-64hh-pfcg-96x7CGA-6j9p-579c-fpj6CGA-6mq9-w23q-w39hCGA-6v3w-g682-p2vpCGA-72jr-jq2w-r4cxCGA-7558-fpgq-j4phCGA-7775-2p96-35rgCGA-78hp-57jm-m39cCGA-79xv-3v67-7fp9CGA-7qqc-p9m9-mf37CGA-7wjq-rpm3-rpgwCGA-86wv-4c29-463pCGA-89r8-6w22-mg4xCGA-8cv6-r5qq-5q59CGA-8h7j-8v8f-7fxrCGA-8jpq-3hgp-5893CGA-8q23-pxg6-5c4pCGA-8wgv-cmv4-76mqCGA-9988-j3x2-6qgjCGA-9f5c-g5mr-gh8pCGA-9mwm-9q4q-pgf2CGA-9qp2-qf39-rp8vCGA-9v4c-vg9g-hp9fCGA-9wh9-qx22-vc47CGA-cm2m-vjxw-xg8gCGA-cm7r-wq76-8m48CGA-cpcj-p535-vj86CGA-f3mx-xcpm-x3wpCGA-f4fh-9cpp-hgwwCGA-fc7q-6cfp-v6qfCGA-fcjq-crpm-6hg4CGA-fg6v-6v7v-p3hmCGA-fjgv-jg72-8589CGA-fqjw-fj48-ggf2CGA-g396-hxp9-8hfxCGA-g43m-79m6-mw3pCGA-g55q-p749-522gCGA-g5hw-xmq3-7fqxCGA-g76g-54g6-mhc3CGA-g7hw-c4r4-qvvjCGA-g93g-5739-c6hqCGA-g9rc-2vv4-4q7vCGA-gc5p-g9p4-c797CGA-gf3v-w59m-45gpCGA-gg68-h8jm-g4vqCGA-gggf-jjc8-3pq3CGA-gprp-2x8q-g6v6CGA-gqj4-4c94-8r76CGA-gw57-jgmw-5c37CGA-h2c6-pjfj-39pwCGA-h499-rgqj-cgj8CGA-h539-39pp-gvw3CGA-hh5h-6wp3-c2pwCGA-hm57-qfp4-xh7rCGA-j3hg-jjqf-2r86CGA-j4w4-j5q7-8jh6CGA-j6w7-27r4-qgxgCGA-j7cw-j7r6-pqxpCGA-jcrf-wppg-8r99CGA-jhwm-mprr-xqp7CGA-jqgr-3x68-9j34CGA-jvf7-6frw-cvxrCGA-m7j2-27g9-9qmcCGA-m9mf-xqch-729qCGA-mh2x-cm6x-68ffCGA-mhc5-5wg3-r8hcCGA-mj3r-c7xh-7q9pCGA-mjc9-8q4r-wwc9CGA-mjjv-whq5-fhhfCGA-mmcp-p8g2-qq3mCGA-mpw8-75gf-8hgpCGA-mw4p-qxwh-mqcjCGA-mwgh-v98f-7gwjCGA-p26m-247q-jc85CGA-p2h8-269v-x9ppCGA-p3j9-qqr5-x4g7CGA-p3m3-wmqp-x2g3CGA-p645-5h88-5525CGA-pf3g-jxmh-vhx8CGA-pg4m-8fqm-rm7qCGA-pqhc-c2g4-x88vCGA-pvrp-r9h9-5qrgCGA-pwph-g838-chhcCGA-q342-v9h9-8fjmCGA-q39w-p72j-8337CGA-q59j-f687-53hpCGA-q5c4-v6mg-5v84CGA-q826-q4mh-88x6CGA-qf68-w43q-3897CGA-qgg9-6j2c-jg8cCGA-qh43-ww2f-5rqpCGA-qmv3-72gj-jgmwCGA-qp27-qc6h-qg56CGA-qqx4-v39c-4g75CGA-qrrg-jq4r-388pCGA-qrvm-q5fx-3jrcCGA-qv9f-q2x4-pv8fCGA-qwhc-q2gm-v379CGA-r4pf-cm42-26qgCGA-r78j-q8qj-9qjjCGA-r8hg-87j9-724rCGA-r8rg-568r-x3c7CGA-rcch-5qjj-hxfgCGA-rf95-x824-8v4wCGA-rhjr-prqf-prfgCGA-rmjf-9cpw-5gppCGA-rp9x-5fmp-5r8cCGA-rww8-48pj-m9vmCGA-v2jv-h69c-33gqCGA-v5p5-2j48-7m2gCGA-v72h-7jj5-rm53CGA-v745-4p28-fhj5CGA-v77m-xv4h-88v9CGA-v8jj-8hw7-w7w5CGA-v938-xfc8-mc6pCGA-vcrq-8f88-q3g8CGA-vjpj-254h-fh26CGA-vp82-mg2c-rj7hCGA-vprh-rc6r-x3f9CGA-vq3f-jxm5-f24hCGA-vqvc-r932-hvjgCGA-w3x5-8p29-mm4gCGA-w569-pqr5-836fCGA-w65v-v3q2-cj7wCGA-w7v9-mr8f-r85pCGA-wjgx-3vrq-74m6CGA-wrv6-2q6h-783xCGA-ww6r-jww7-hc5fCGA-wwhc-xwrr-wq43CGA-x33p-7wcm-r2q3CGA-x78g-gmf3-qcr4CGA-x98f-5r6c-hr8qCGA-xc6f-crr7-324gCGA-xcpj-8qg3-px78CGA-xgw9-6h8q-mgqwCGA-xq8q-mrg5-2j9rCGA-xv8j-qxc7-2pcpCGA-xx7g-844p-57vfCGA-xxgg-q92h-8vcmCGA-q36g-25mx-vgw2CGA-x2x6-cv7p-xg43
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 09 Feb 2026, 20:11
Last modified:10 Sept 2026, 12:05
Vulnerability Summary
Overall Risk (default)
medium
41/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
2.83% LOW
3% probability +2.78%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
09 Feb 2026, 20:11
Published
Vulnerability first disclosed
10 Sept 2026, 12:05
Last Modified
Vulnerability information updated
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 2.83%• Percentile: 86%
Techniques & Countermeasures
- CWE-754•Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
- CWE-1287•Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Affected Systems
- chainguard•arangodb-3.11
< 3.11.14.5-r13
- chainguard•awx
< 24.6.1-r42
- chainguard•gitlab-rails-ce-18.1
all
- chainguard•gitlab-rails-ce-18.10
all
- chainguard•gitlab-rails-ce-18.11
< 18.11.6-r7 | all
- chainguard•gitlab-rails-ce-18.5
all
- chainguard•gitlab-rails-ce-18.6
all
- chainguard•gitlab-rails-ce-18.7
all
- chainguard•gitlab-rails-ce-18.8
all
- chainguard•gitlab-rails-ce-18.9
all
- chainguard•gitlab-rails-ce-19.0
all | < 19.0.3-r1
- chainguard•gitlab-rails-ce-19.1
all | < 19.1.3-r7 | < 19.1.7-r6
- chainguard•gitlab-rails-ce-19.2
all | < 19.2.4-r4 | < 19.2.5-r2
- chainguard•gitlab-rails-ce-19.3
< 19.3.1-r4 | < 19.3.1-r6
- chainguard•gitlab-rails-ce-fips-18.1
all
- chainguard•gitlab-rails-ce-fips-18.10
all
- chainguard•gitlab-rails-ce-fips-18.11
< 18.11.7-r1 | all
- chainguard•gitlab-rails-ce-fips-18.5
all
- chainguard•gitlab-rails-ce-fips-18.6
all
- chainguard•gitlab-rails-ce-fips-18.7
all
- chainguard•gitlab-rails-ce-fips-18.8
all
- chainguard•gitlab-rails-ce-fips-18.9
all
- chainguard•gitlab-rails-ce-fips-19.0
all
- chainguard•gitlab-rails-ce-fips-19.1
< 19.1.1-r1 | all | < 19.1.7-r7
- chainguard•gitlab-rails-ce-fips-19.2
all | < 19.2.5-r2
- chainguard•gitlab-rails-ce-fips-19.3
< 19.3.1-r3
- chainguard•jitsucom-jitsu-console
< 2.11.0-r15
- chainguard•katib-earlystopping
< 0.19.0-r31
- chainguard•katib-suggestion-goptuna-compat
all
- chainguard•katib-suggestion-hyperband
< 0.19.0-r31
- chainguard•katib-suggestion-hyperopt
< 0.19.0-r31 | < 0.19.0-r40
- chainguard•katib-suggestion-nas-darts
< 0.19.0-r31
- chainguard•katib-suggestion-nas-enas
< 0.19.0-r31
- chainguard•katib-suggestion-optuna-enas
< 0.19.0-r31
- chainguard•katib-suggestion-pbt-enas
< 0.19.0-r31
- chainguard•katib-suggestion-skopt-enas
< 0.19.0-r31
- chainguard•katib-tfevent-metricscollector
< 0.19.0-r31
- chainguard•kibana-7
all
- chainguard•kibana-8.17
< 8.17.10-r10 | < 8.17.10-r9
- chainguard•kibana-8.17-iamguarded
< 8.17.10-r10 | < 8.17.10-r9
- chainguard•kibana-8.18
< 8.18.8-r10
- chainguard•kibana-8.18-iamguarded
< 8.18.8-r10
- chainguard•kibana-8.19
< 8.19.11-r1
- chainguard•kibana-8.19-bitnami
< 8.19.11-r1
- chainguard•kibana-8.19-iamguarded
< 8.19.11-r1
- chainguard•kibana-9.0
< 9.0.8-r10
- chainguard•kibana-9.0-bitnami
< 9.0.8-r10
- chainguard•kibana-9.0-iamguarded
< 9.0.8-r10
- chainguard•kibana-9.1
< 9.1.10-r5
- chainguard•kibana-9.1-iamguarded
< 9.1.10-r5
Showing first 50 affected entries in server-rendered view.
References (58)
- https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
- https://github.com/axios/axios/pull/7369
- https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
- https://github.com/axios/axios
- https://github.com/axios/axios/releases/tag/v1.13.5
- https://nvd.nist.gov/vuln/detail/CVE-2026-25639
- https://github.com/axios/axios/pull/7388
- https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e
- https://github.com/axios/axios/releases/tag/v0.30.3
- https://github.com/axios/axios/releases/tag/v0.30.0
- https://access.redhat.com/security/cve/CVE-2026-25639
- https://bugzilla.redhat.com/show_bug.cgi?id=2438237
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25639.json
- https://access.redhat.com/errata/RHSA-2026:6277
- https://access.redhat.com/errata/RHSA-2026:6428
- https://access.redhat.com/errata/RHSA-2026:5633
- https://access.redhat.com/errata/RHSA-2026:8229
- https://access.redhat.com/errata/RHSA-2026:13548
- https://access.redhat.com/errata/RHSA-2026:6308
- https://access.redhat.com/errata/RHSA-2026:6309
- https://access.redhat.com/errata/RHSA-2026:6174
- https://access.redhat.com/errata/RHSA-2026:6802
- https://access.redhat.com/errata/RHSA-2026:2694
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:5807
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:7249
- https://access.redhat.com/errata/RHSA-2026:5142
- https://access.redhat.com/errata/RHSA-2026:5174
- https://access.redhat.com/errata/RHSA-2026:6192
- https://access.redhat.com/errata/RHSA-2026:6170
- https://access.redhat.com/errata/RHSA-2026:3107
- https://access.redhat.com/errata/RHSA-2026:3106
- https://access.redhat.com/errata/RHSA-2026:3105
- https://access.redhat.com/errata/RHSA-2026:3109
- https://access.redhat.com/errata/RHSA-2026:4942
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:6497
- https://access.redhat.com/errata/RHSA-2026:6567
- https://access.redhat.com/errata/RHSA-2026:5665
- https://access.redhat.com/errata/RHSA-2026:5168
- https://access.redhat.com/errata/RHSA-2026:8499
- https://access.redhat.com/errata/RHSA-2026:8500
- https://access.redhat.com/errata/RHSA-2026:8501
- https://access.redhat.com/errata/RHSA-2026:3087
- https://access.redhat.com/errata/RHSA-2026:13542
- https://access.redhat.com/errata/RHSA-2026:9848
- https://access.redhat.com/errata/RHSA-2026:5636
- https://access.redhat.com/errata/RHSA-2026:8218
- https://access.redhat.com/errata/RHSA-2026:11414
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:40138
- https://access.redhat.com/errata/RHSA-2026:41064
- https://security-tracker.debian.org/tracker/CVE-2026-25639
- https://ubuntu.com/security/CVE-2026-25639
- https://www.cve.org/CVERecord?id=CVE-2026-25639
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25639.json