CVE-2026-25639

Name: CVE-2026-25639
Creator: NVD / NIST
Published: 2026-02-09T21:15:49.01+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.24%

Last modified Jun 17, 2026

CVE-2026-25639 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. EPSS estimates a 1.24% chance of exploitation in the next 30 days.

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

1.24%

65.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-754

Affected Software

Vendor	Product	Versions
Axios	Axios	< 0.30.3
Axios	Axios	>= 1.0.0, < 1.13.5

References

https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57Patch
https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9ePatch
https://github.com/axios/axios/pull/7369Issue Tracking
https://github.com/axios/axios/pull/7388Issue Tracking
https://github.com/axios/axios/releases/tag/v0.30.3Release Notes
https://github.com/axios/axios/releases/tag/v1.13.5Product, Release Notes
https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433Exploit, Vendor Advisory

Timeline

Published: Feb 9, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-25639?

How severe is CVE-2026-25639?

CVE-2026-25639 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.24% probability of exploitation in the next 30 days.

How do I fix CVE-2026-25639?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-25639?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST