Security vulnerabilities and automated fixes for cve 2026 25639 issues
2 posts found
A high-severity denial of service vulnerability (CVE-2026-25639) was discovered in Axios versions prior to 1.13.5, where the `mergeConfig` function failed to properly sanitize the `__proto__` key in configuration objects. This prototype pollution vulnerability could allow attackers to crash Node.js applications or cause unexpected behavior by manipulating JavaScript's prototype chain. The fix involved upgrading from Axios 1.13.2 to 1.18.0, which includes enhanced input validation in the configur
A critical prototype pollution vulnerability in axios versions 1.12.0 and earlier could allow attackers to trigger denial of service attacks by poisoning the configuration object through the `__proto__` key. The vulnerability was fixed by upgrading axios to 1.13.5 and updating related dependencies like follow-redirects to 1.16.0, which implements stricter input validation in the mergeConfig function.