Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
| Vendor | Product | Versions |
|---|---|---|
| axios | axios | < 1.13.5, 1.14.1, 0.30.4 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ibm | rational build forge | cert_advisory | 90% |
| ibm | ibm app connect enterprise | cert_advisory | 90% |
| red hat | ansible automation | cert_advisory | 90% |
| red hat | openshift | cert_advisory | 90% |
| red hat | red hat enterprise linux | cert_advisory | 90% |
