Axios, a popular HTTP client for Node.js, is vulnerable to a denial-of-service (DoS) attack (CVE-2026-25639) and a malware injection (GHSA-fw8c-xr5c-95f9). The DoS vulnerability can be triggered by a malicious configuration object, while the malware injects a remote access trojan. Patches are available to address these issues; update immediately to mitigate the risks.
CVE-2026-25639 has a CVSS score of 7.5, indicating high severity.
What is Axios?
CVE-2026-25639: Denial of Service via __proto__ Key
High severity: An attacker can crash the application.
The EPSS score is 0.049, indicating a low probability of exploitation.
The `mergeConfig` function in Axios crashes when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, leading to a denial of service.
How to fix CVE-2026-25639 in Axios
Patch immediately- 1.Update Axios to version 1.13.5 or later.
npm update axiosWorkaround: Avoid passing user-controlled JSON directly to Axios configuration methods. Sanitize or validate the input before passing it to Axios.
NextGuard automatically flags CVE-2026-25639 if Axios appears in any of your monitored projects — no manual lookup required.
Stay ahead of nodejs vulnerabilities
Proactively detect and remediate vulnerabilities in your nodejs projects. Use NextGuard to monitor your nodejs dependencies.
Compare PlansFrequently asked questions
Axios users should update to the latest version to mitigate the risk of denial-of-service attacks and malware injection. Stay informed about the latest security threats and see all nodejs vulnerabilities. Regularly audit your dependencies to ensure a secure application environment.
Related topics