⬆️(dependencies) update axios to v1.13.5 [SECURITY] by renovate[bot] · Pull Request #13 · suitenumerique/calc

renovate · 2026-02-13T16:12:19Z

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.9.0` → `1.13.5`

GitHub Vulnerability Alerts

CVE-2026-25639

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Release Notes

axios/axios (axios)

`v1.13.5`

Compare Source

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)
Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)
Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)
Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)
CI: update workflow YAMLs. (PR #7372)
CI: fix run condition. (PR #7373)
Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)
@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

`v1.13.4`

Compare Source

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)
- Fixed issues discovered in v1.13.3 release
- Cleaned up interceptor test files
- Improved workflow configurations

Infrastructure & CI/CD

refactor: ci and build (#7340) (8ff6c19)
- Major refactoring of CI/CD workflows
- Consolidated workflow files for better maintainability
- Added mise configuration for the development environment
- Improved sponsor block update automation
- Enhanced issue and PR templates
- Added automatic release notes generation
- Implemented workflow cancellation for concurrent runs
chore: codegen and some updates to workflows (76cf77b)
- Code generation improvements
- Workflow optimisations

Migration Notes

Breaking Changes

None in this release.

Deprecations

None in this release.

Contributors

Thank you to all contributors who made this release possible! Special thanks to:

jasonsaayman - Release management and CI/CD improvements

`v1.13.3`

Compare Source

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
interceptor: handle the error in the same interceptor (#6269) (5945e40)
main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)
add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
added copilot instructions (3f83143)
compatibility with frozen prototypes (#6265) (860e033)
enhance pipeFileToResponse with error handling (#7169) (88d7884)
types: Intellisense for string literals in a widened union (#6134) (f73474d), closes /github.com/microsoft/TypeScript/issues/33471#issuecomment-1376364329

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

`v1.13.2`

Compare Source

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

`v1.13.1`

Compare Source

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

`v1.13.0`

Compare Source

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

types: fixed env config types; (#7020) (b5f26b7)

Contributors to this release

Dmitriy Mozgovoy

`v1.12.2`

Compare Source

Bug Fixes

fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

`v1.12.1`

Compare Source

Bug Fixes

types: fixed env config types; (#7020) (b5f26b7)

Contributors to this release

Dmitriy Mozgovoy

`v1.12.0`

Compare Source

Bug Fixes

adding build artifacts (9ec86de)
dont add dist on release (a2edc36)
fetch-adapter: set correct Content-Type for Node FormData (#6998) (a9f47af)
node: enforce maxContentLength for data: URLs (#7011) (945435f)
package exports (#5627) (aa78ac2)
params: removing '[' and ']' from URL encode exclude characters (#3316) (#5715) (6d84189)
release pr run (fd7f404)
types: change the type guard on isCancel (#5595) (0dbb7fd)

Features

adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
support reviver on JSON.parse (#5926) (2a97634), closes #5924
types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

`v1.11.0`

Compare Source

Bug Fixes

form-data npm pakcage (#6970) (e72c193)
prevent RangeError when using large Buffers (#6961) (a2214ca)
types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

`v1.10.0`

Compare Source

Bug Fixes

adapter: pass fetchOptions to fetch function (#6883) (0f50af8)
form-data: convert boolean values to strings in FormData serialization (#6917) (5064b10)
package: add module entry point for React Native; (#6933) (3d343b8)

Features

types: improved fetchOptions interface (#6867) (63f1fce)

Contributors to this release

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-02-13T16:13:05Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
@html-to/text-cli@0.5.4
mjml@4.15.3
axios@1.9.0 ⏵ 1.13.5	^-1	⁺²²

View full report

socket-security · 2026-02-13T16:13:07Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `js-beautify` is 100.0% likely obfuscated Confidence: 1.00 Location: Package overview From: `?` → `npm/mjml@4.15.3` → `npm/js-beautify@1.15.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-beautify@1.15.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

renovate bot added dependencies noChangeLog labels Feb 13, 2026

renovate bot changed the title ~~⬆️(dependencies) update axios to v1.13.5 [SECURITY]~~ ⬆️(dependencies) update axios to v1.13.5 [SECURITY] - autoclosed Feb 19, 2026

renovate bot closed this Feb 19, 2026

renovate bot deleted the renovate/npm-axios-vulnerability branch February 19, 2026 11:28

⬆️(dependencies) update axios to v1.13.5 [SECURITY]

2b45737

renovate bot changed the title ~~⬆️(dependencies) update axios to v1.13.5 [SECURITY] - autoclosed~~ ⬆️(dependencies) update axios to v1.13.5 [SECURITY] Feb 21, 2026

renovate bot reopened this Feb 21, 2026

renovate bot force-pushed the renovate/npm-axios-vulnerability branch 2 times, most recently from cbc05cb to 2b45737 Compare February 21, 2026 06:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

⬆️(dependencies) update axios to v1.13.5 [SECURITY]#13

⬆️(dependencies) update axios to v1.13.5 [SECURITY]#13
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-axios-vulnerability

renovate bot commented Feb 13, 2026

Uh oh!

socket-security bot commented Feb 13, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Feb 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Feb 13, 2026

GitHub Vulnerability Alerts

Denial of Service via proto Key in mergeConfig

Summary

Details

PoC

Impact

Release Notes

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

Overview

What's New in v1.13.4

Bug Fixes

Infrastructure & CI/CD

Migration Notes

Breaking Changes

Deprecations

Contributors

Bug Fixes

Features

Reverts

Contributors to this release

Bug Fixes

Performance Improvements

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Features

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Features

Contributors to this release

Bug Fixes

Contributors to this release

Bug Fixes

Features

Contributors to this release

Configuration

Uh oh!

socket-security bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

socket-security bot commented Feb 13, 2026 •

edited

Loading

socket-security bot commented Feb 13, 2026 •

edited

Loading