HTTP Library Flaw Lets Attackers Crash Your Server with One Request

Vulnerability Explanation

The `mergeConfig` function in `lib/core/mergeConfig.js` iterates over the merged keys of two config objects using `Object.keys({ ...config1, ...config2 })`. When a config object is created via `JSON.parse()` with a `__proto__` key (e.g., `JSON.parse('{"__proto__": {"x": 1}}')`), `JSON.parse` treats `__proto__` as a plain own enumerable property rather than a prototype accessor. `Object.keys()` then includes `'__proto__'` in the iteration. Inside the loop, `mergeMap['__proto__']` performs a prototype chain lookup and resolves to `Object.prototype` (a truthy non-function object). The expression `mergeMap[prop] || mergeDeepProperties` therefore evaluates to `Object.prototype`, which is then invoked as a function — throwing `TypeError: merge is not a function`. This unhandled exception crashes the Node.js process. The crash path is reachable through every public Axios method: `axios.get()`, `axios.post()`, `axios.request()`, `axios.getUri()`, and all other HTTP shortcut methods.

Root Cause

The `mergeConfig` function does not validate or filter dangerous prototype-related keys (`__proto__`, `constructor`, `prototype`) before using them as property lookups on `mergeMap`. Because `mergeMap` is a plain object, a lookup for `__proto__` traverses the prototype chain and returns `Object.prototype` instead of `undefined`, producing a truthy non-function value that is subsequently called as a function.

Technical Impact

Remote, unauthenticated denial of service. An attacker who can influence any JSON input that flows into an Axios config object can crash the Node.js process with a single HTTP request. No data is read or written — availability is the sole impact. The attack can be repeated to prevent service recovery.

Severity Justification

CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-reachable, no authentication required, no user interaction, complete availability impact. Exploitability is conditional on the application passing user-controlled JSON into Axios config, which is a common pattern.

Affected Components

• axios < 0.30.3 (0.x legacy branch)
• axios >= 1.0.0 < 1.13.5 (1.x current branch)

Remediation Steps

1. Upgrade Axios to the patched version for your branch: `npm install axios@latest` (1.x) or `npm install axios@0.30.3` (0.x legacy). Run `npm list axios` afterwards to confirm the resolved version.
2. If you cannot upgrade immediately, add input sanitization before passing any user-supplied JSON to Axios config: strip or reject objects containing `__proto__`, `constructor`, or `prototype` as own keys.
3. Wrap Axios calls that process user-controlled config in a try/catch block as a short-term resilience measure — this prevents a single bad request from crashing the entire process, though it does not fix the root cause.
4. After upgrading, audit all code paths where `JSON.parse()` output (or any user-supplied object) is spread or passed directly into an Axios request config parameter.
5. Run `npm audit` to confirm no remaining advisories for Axios and to check for transitive dependencies that may pin an older version.

Verification Steps

1. Run `npm list axios` and confirm the resolved version is >= 1.13.5 (or >= 0.30.3 for the 0.x branch).
2. Run `npm audit` and verify no CVE-2026-25639 findings are reported.
3. In a non-production environment, execute the PoC: `node -e "import('axios').then(({default: axios}) => axios.get('http://localhost', JSON.parse('{\"__proto__\": {\"x\": 1}}')))"` — on a patched version this should throw a network error (not a TypeError crash).
4. Check your CI pipeline's dependency lock file (`package-lock.json` or `yarn.lock`) to ensure no nested dependency is resolving an older Axios version.

Code Examples (javascript)

// Vulnerable: user-controlled JSON passed directly to axios config
app.post('/proxy', async (req, res) => {
  const userConfig = JSON.parse(req.body.config); // attacker controls this
  const response = await axios.get('https://api.example.com/data', userConfig);
  // ^ crashes with TypeError if userConfig contains __proto__
  res.json(response.data);
});

// Fixed option 1: upgrade to axios >= 1.13.5 (primary fix)
// Fixed option 2: sanitize config before passing to axios
const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

function sanitizeConfig(obj) {
  if (obj === null || typeof obj !== 'object') return obj;
  return Object.fromEntries(
    Object.entries(obj)
      .filter(([key]) => !DANGEROUS_KEYS.has(key))
      .map(([key, val]) => [key, sanitizeConfig(val)])
  );
}

app.post('/proxy', async (req, res) => {
  const rawConfig = JSON.parse(req.body.config);
  const safeConfig = sanitizeConfig(rawConfig); // belt-and-suspenders
  const response = await axios.get('https://api.example.com/data', safeConfig);
  res.json(response.data);
});

Best Practices

• Never pass raw `JSON.parse()` output directly into library configuration objects — always validate or allowlist the expected fields.
• Use `Object.create(null)` for lookup maps (like `mergeMap`) to avoid prototype chain pollution; plain `{}` objects inherit from `Object.prototype`.
• Add `npm audit` or a software composition analysis (SCA) tool to your CI pipeline to catch vulnerable dependency versions before they reach production.
• Wrap external HTTP client calls in try/catch blocks so that unexpected runtime errors degrade gracefully rather than crashing the process.

References

• github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
• nvd.nist.gov/vuln/detail/CVE-2026-25639
• github.com/axios/axios/pull/7369
• github.com/axios/axios/releases/tag/v1.13.5
• github.com/axios/axios/releases/tag/v0.30.3