CVE-2026-21697

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

• CWE-362

• https://github.com/rezmoss/axios4go/commit/b651604c64e66a115ab90cdab358b0181d74a842Patch
• https://github.com/rezmoss/axios4go/releases/tag/v0.6.4Product
• https://github.com/rezmoss/axios4go/security/advisories/GHSA-cmj9-27wj-7x47Mitigation, Vendor Advisory

Published

Jan 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21691iccDEV provides a set of libraries and tools that allow for …6.5
• CVE-2026-21692iccDEV provides a set of libraries and tools that allow for …8.8
• CVE-2026-21693iccDEV provides a set of libraries and tools that allow for …8.8
• CVE-2026-21694Titra is open source project time tracking software. Version…8.1
• CVE-2026-21695Titra is open source project time tracking software. In vers…4.3
• CVE-2026-21696Wings is the server control plane for Pterodactyl, a free, o…6.5
• CVE-2026-21708A vulnerability allowing a Backup Viewer to perform remote c…9.9
• CVE-2026-21709A vulnerability allowing a local attacker with administrator…6.7
• CVE-2026-2171A vulnerability was found in code-projects Online Student Ma…9.8
• CVE-2026-21710A flaw in Node.js HTTP request handling causes an uncaught `…7.5
• CVE-2026-21711A flaw in Node.js Permission Model network enforcement leave…5.3
• CVE-2026-21712A flaw in Node.js URL processing causes an assertion failure…6.5