7.5

CVE-2026-25639: Axios affected by Denial of Service via __proto__ Key in mergeConfig

Modified
AliasesUBUNTU-CVE-2026-25639DEBIAN-CVE-2026-25639CGA-29mj-2qp4-9w5w
Published 09-02-2026Last modified 10-09-2026

Vulnerability summary

CVE-2026-25639 is a high (CVSS 7.5) vulnerability in axios. EPSS estimates a 2.80% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
2.80%
0%100%
Low · +1.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
RHSA-2026:6277CGA-7WF9-6QPG-MV6M

Timeline

  1. 09-02-2026
    PublishedVulnerability first disclosed.
  2. 10-09-2026
    Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

2.80%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +1.00 pp

From 1.80% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Axios

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard72 products
  • arangodb-3.11< 3.11.14.5-r13
  • awx< 24.6.1-r42
  • gitlab-rails-ce-18.1All versions (No fix recorded)
  • gitlab-rails-ce-18.10All versions (No fix recorded) | < 18.10.8-r8
  • gitlab-rails-ce-18.11< 18.11.6-r7 | All versions (No fix recorded) | < 18.11.13-r0
Wolfi18 products
  • jitsucom-jitsu-console< 2.11.0-r15
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
Axios1 product
  • axios< 0.30.3 | ≥ 1.0.0, < 1.13.5
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.14.0+dfsg-1
Npm1 product
  • axios≥ 1.0.0, < 1.13.5 | < 0.30.3
Ubuntu1 product
  • node-axiosAll versions (No fix recorded)

6 vendors · 94 products

References

56 links
Show all 56 references