fix(deps): update dependency axios to v1.13.5 [security] by abrain-bot · Pull Request #330 · alarmdisplay/hub

abrain-bot · 2026-02-22T13:26:39Z

This PR contains the following updates:

Package	Type	Update	Change
axios (source)	dependencies	minor	`1.12.2` -> `1.13.5`

GitHub Vulnerability Alerts

CVE-2026-25639

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Release Notes

axios/axios (axios)

`v1.13.5`

Compare Source

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)
Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)
Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)
Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)
CI: update workflow YAMLs. (PR #7372)
CI: fix run condition. (PR #7373)
Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)
@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

`v1.13.4`

Compare Source

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)
- Fixed issues discovered in v1.13.3 release
- Cleaned up interceptor test files
- Improved workflow configurations

Infrastructure & CI/CD

refactor: ci and build (#7340) (8ff6c19)
- Major refactoring of CI/CD workflows
- Consolidated workflow files for better maintainability
- Added mise configuration for the development environment
- Improved sponsor block update automation
- Enhanced issue and PR templates
- Added automatic release notes generation
- Implemented workflow cancellation for concurrent runs
chore: codegen and some updates to workflows (76cf77b)
- Code generation improvements
- Workflow optimisations

Migration Notes

Breaking Changes

None in this release.

Deprecations

None in this release.

Contributors

Thank you to all contributors who made this release possible! Special thanks to:

jasonsaayman - Release management and CI/CD improvements

`v1.13.3`

Compare Source

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
interceptor: handle the error in the same interceptor (#6269) (5945e40)
main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)
add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
added copilot instructions (3f83143)
compatibility with frozen prototypes (#6265) (860e033)
enhance pipeFileToResponse with error handling (#7169) (88d7884)
types: Intellisense for string literals in a widened union (#6134) (f73474d), closes /github.com/microsoft/TypeScript/issues/33471#issuecomment-1376364329

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

`v1.13.2`

Compare Source

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

`v1.13.1`

Compare Source

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

`v1.13.0`

Compare Source

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

types: fixed env config types; (#7020) (b5f26b7)

Contributors to this release

Dmitriy Mozgovoy

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

codecov · 2026-02-22T13:29:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.33%. Comparing base (52015e8) to head (9826b1d).
⚠️ Report is 2 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #330   +/-   ##
========================================
  Coverage    56.33%   56.33%           
========================================
  Files          102      102           
  Lines         1555     1555           
  Branches       209      209           
========================================
  Hits           876      876           
  Misses         659      659           
  Partials        20       20

Flag	Coverage Δ
server	`56.33% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

abrain-bot changed the title ~~fix(deps): update dependency axios to v1.13.5 [security]~~ fix(deps): update dependency axios to v1.13.5 [security] - autoclosed Feb 22, 2026

abrain-bot closed this Feb 22, 2026

abrain-bot deleted the renovate/npm-axios-vulnerability branch February 22, 2026 20:26

abrain-bot changed the title ~~fix(deps): update dependency axios to v1.13.5 [security] - autoclosed~~ fix(deps): update dependency axios to v1.13.5 [security] Feb 26, 2026

abrain-bot reopened this Feb 26, 2026

abrain-bot force-pushed the renovate/npm-axios-vulnerability branch from b69a6cb to 1295cef Compare February 26, 2026 21:26

fix(deps): update dependency axios to v1.13.5 [security]

9826b1d

abrain-bot force-pushed the renovate/npm-axios-vulnerability branch from 1295cef to 9826b1d Compare February 26, 2026 22:26

abrain merged commit 98f576f into develop Feb 27, 2026
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency axios to v1.13.5 [security]#330

fix(deps): update dependency axios to v1.13.5 [security]#330
abrain merged 1 commit intodevelopfrom
renovate/npm-axios-vulnerability

abrain-bot commented Feb 22, 2026

Uh oh!

codecov bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

abrain-bot commented Feb 22, 2026

GitHub Vulnerability Alerts

CVE-2026-25639

Denial of Service via proto Key in mergeConfig

Summary

Details

PoC

Impact

Release Notes

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

v1.13.4

Overview

What's New in v1.13.4

Bug Fixes

Infrastructure & CI/CD

Migration Notes

Breaking Changes

Deprecations

Contributors

v1.13.3

Bug Fixes

Features

Reverts

Contributors to this release

v1.13.2

Bug Fixes

Performance Improvements

Contributors to this release

v1.13.1

Bug Fixes

Contributors to this release

v1.13.0

Bug Fixes

Features

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

Contributors to this release

Configuration

Uh oh!

codecov bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

`v1.13.5`

`v1.13.4`

`v1.13.3`

`v1.13.2`

`v1.13.1`

`v1.13.0`

codecov bot commented Feb 22, 2026 •

edited

Loading