Skip to content
Fencer Vulns
high 7.5

CVE-2026-25639 json

Axios affected by Denial of Service via __proto__ Key in mergeConfig

published 2026-02-09 8 mo ago modified 2026-09-10 59 d ago also EUVD-2026-6850 , GHSA-43fc-jf86-j433

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Patch / fix

  • npm axios 0.30.3, 1.13.5
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.7-1.el9ap
  • Red Hat multicluster engine for Kubernetes 2.1 1777128790
  • Red Hat multicluster engine for Kubernetes 2.6 1776223790
  • Red Hat multicluster engine for Kubernetes 2.7 1773100128
  • Red Hat multicluster engine for Kubernetes 2.8 1775116156
  • Red Hat multicluster engine for Kubernetes 2.9 1777301444
  • Red Hat Network Observability (NETOBSERV) 1.11.0 1774431392, 1774431617
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 1783350952
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12 1773259174
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1775116130
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126
  • Red Hat Red Hat Ansible Automation Platform 2.5 1774446874
  • Red Hat Red Hat Ansible Automation Platform 2.6 1774243862, 1774363040
  • Red Hat Red Hat Developer Hub 1.8 1774545605
  • Red Hat Red Hat Developer Hub 1.9 1775140647
  • Red Hat Red Hat Discovery 2 1770913709
  • Red Hat Red Hat Migration Toolkit 1.8 1780590717
  • Red Hat Red Hat OpenShift AI 2.16 1774282136
  • Red Hat Red Hat OpenShift AI 2.25 1776742021, 1776742141
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627
  • Red Hat Red Hat OpenShift Container Platform 4.19 1775577192
  • Red Hat Red Hat OpenShift Container Platform 4.20 1773746857
  • Red Hat Red Hat OpenShift Container Platform 4.21 1773849532
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 1774227265, 1774448966, 1774476526
  • Red Hat Red Hat OpenShift Pipelines 1.21 1774871390
  • Red Hat Red Hat OpenShift Service Mesh 2.6 1771229736, 1771230055
  • Red Hat Red Hat OpenShift Service Mesh 3.0 1771372940, 1771373071
  • Red Hat Red Hat OpenShift Service Mesh 3.1 1771372942, 1771385160
  • node-axios Debian 14 1.14.0+dfsg-1

debian advisories DEBIAN-CVE-2026-25639

  • python3.12-pillow ansible automation platform 2.6 12.1.1-1.el9ap
  • automation-platform-ui ansible automation platform 2.6 2.6.7-1.el9ap
  • automation-gateway-proxy ansible automation platform 2.6 2.6.14-1.el9
  • automation-gateway-proxy-server ansible automation platform 2.6 2.6.14-1.el9

red hat advisories RHSA-2026:6277

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-25639 updated cvss 7.5

axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/elasticsearch6-rhel9, openshift-logging/logging-curator5-rhel9, openshift-logging/elasticsearch-proxy-rhel9, openshift-logging/elasticsearch-rhel9-operator, openshift-logging/elasticsearch-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-tech-preview/automation-dashboard-rhel9
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-gitops-sync-rhel9 Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Fuse 7 axios 0.19.2, io.apicurio-apicurito
    affected: workaround, no fix available, no fix planned “Will not fix”
show 27 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1776223790
    fixed: vendor fix RHSA-2026:9848
  • Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine 1773100128
    fixed: vendor fix RHSA-2026:5636
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1775116156
    fixed: vendor fix RHSA-2026:8218
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1777301444
    fixed: vendor fix RHSA-2026:11414
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine 1777128790
    fixed: vendor fix RHSA-2026:13542
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1774431392, network-observability 1774431617
    fixed: vendor fix RHSA-2026:6428
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/console-rhel9 1783350952
    fixed: vendor fix RHSA-2026:41064
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 rhacm2 1773259174
    fixed: vendor fix RHSA-2026:5633
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1775116130
    fixed: vendor fix RHSA-2026:8229
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1783451729
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1776927126
    fixed: vendor fix RHSA-2026:13548
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1774446874
    fixed: vendor fix RHSA-2026:6308
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1774243862, ansible-automation-platform-26 1774363040
    fixed: vendor fix RHSA-2026:6309
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.7-1.el9ap
    fixed: vendor fix RHSA-2026:6277
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Developer Hub 1.8 rhdh 1774545605
    fixed: vendor fix RHSA-2026:6174
  • Red Hat Developer Hub 1.9 rhdh 1775140647
    fixed: vendor fix RHSA-2026:6802
  • Red Hat Discovery 2 discovery 1770913709
    fixed: vendor fix RHSA-2026:2694
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1780590717
    fixed: vendor fix RHSA-2026:25041
  • Red Hat OpenShift AI 2.16 rhoai 1774282136
    fixed: vendor fix RHSA-2026:5807
  • Red Hat OpenShift AI 2.25 rhoai 1776742021, rhoai 1776742141
    fixed: vendor fix RHSA-2026:10184
  • Red Hat OpenShift AI 3.3 rhoai 1778473763, rhoai 1778666987, rhoai 1779189627
    fixed: vendor fix RHSA-2026:19712
  • Red Hat OpenShift Container Platform 4.19 openshift4 1775577192
    fixed: vendor fix RHSA-2026:7249
  • Red Hat OpenShift Container Platform 4.20 openshift4 1773746857
    fixed: vendor fix RHSA-2026:5142
  • Red Hat OpenShift Container Platform 4.21 openshift4 1773849532
    fixed: vendor fix RHSA-2026:5174

13 more fixed, 51 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

2.76% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm axios
>=1.0.0, <1.13.5
<0.30.3
1.13.5
0.30.3

Affected products

  • axios axios
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.7
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Network Observability (NETOBSERV) 1.11.0
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat OpenShift AI 2.16
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat OpenShift Pipelines 1.21
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat Build of Kueue

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions
  • CWE-1287 Improper Validation of Specified Type of Input
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.