UpHeron
All vulnerabilities

npm

CVE-2026-25639

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Severity
High 7.5
Published
9 Feb 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
0.30.3, 1.13.5
Also known as
GHSA-43fc-jf86-j433
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
axiosnpm · osv:npm:axios
  • Every version before 0.30.3
  • From 1.0.0 before 1.13.5

References