🚨 [security] Update axios 1.12.2 → 1.13.5 (minor) by depfu[bot] · Pull Request #61 · nanite-systems/stream

depfu · 2026-02-09T18:08:35Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ axios (1.12.2 → 1.13.5) · Repo · Changelog

Security Advisories 🚨

🚨 Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property

Object.keys() includes '__proto__' in the iteration

mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)

The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype

Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75

Axios.getUri() at lib/core/Axios.js:201

All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC
import axios from "axios";
const maliciousConfig = JSON.parse('{"proto": {"x": 1}}');

await axios.get("https://httpbin.org/get", maliciousConfig);
Reproduction steps:

Clone axios repository or npm install axios

Create file poc.mjs with the code above

Run: node poc.mjs

Observe the TypeError crash

Verified output (axios 1.13.4):
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
Control tests performed:

Test Config Result

Normal config {"timeout": 5000} SUCCESS

Malicious config JSON.parse('{"__proto__": {"x": 1}}') CRASH

Nested object {"headers": {"X-Test": "value"}} SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests

Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Release Notes

1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)

Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)

Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)

Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)

CI: update workflow YAMLs. (PR #7372)

CI: fix run condition. (PR #7373)

Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)

Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)

@asmitha-16 (first contribution — PR #7326)

Full Changelog: v1.13.4...v1.13.5

1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)

Fixed issues discovered in v1.13.3 release

Cleaned up interceptor test files

Improved workflow configurations

Infrastructure & CI/CD

refactor: ci and build (#7340) (8ff6c19)

Major refactoring of CI/CD workflows

Consolidated workflow files for better maintainability

Added mise configuration for the development environment

Improved sponsor block update automation

Enhanced issue and PR templates

Added automatic release notes generation

Implemented workflow cancellation for concurrent runs

chore: codegen and some updates to workflows (76cf77b)

Code generation improvements

Workflow optimisations

Migration Notes

Breaking Changes

None in this release.

Deprecations

None in this release.

Contributors

Thank you to all contributors who made this release possible! Special thanks to:

jasonsaayman - Release management and CI/CD improvements

1.13.3

Release notes:

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes /github.com/microsoft/TypeScript/issues/33471#issuecomment-1376364329

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

JohnTitor

rohit miryala

Wilson Mun

techcodie

Ved Vadnere

svihpinc

SANDESH LENDVE

Lubos

Jarred Sumner

Adam Hines

Subhan Kumar Rai

Joseph Frazier

KT0803

Albie

Jake Hayes

1.13.2

Release notes:

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

1.13.1

Release notes:

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

1.13.0

Release notes:

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

Anchal Singh

Rahul Kumar

Amit Verma

Abhishek3880

Dhvani Maktuporia

Usama Ayoub

ikuy1203

Nikhil Simon Toppo

Jane Wangari

Supakorn Ieamgomol

Kian-Meng Ang

UTSUMI Keiji

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

changeset-bot · 2026-02-09T18:08:47Z

⚠️ No Changeset found

Latest commit: 0fe9cc7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

depfu · 2026-04-08T16:19:31Z

Closed in favor of #66.

Update axios to version 1.13.5

0fe9cc7

depfu Bot added the depfu label Feb 9, 2026

depfu Bot requested a review from microwavekonijn February 9, 2026 18:08

depfu Bot added the depfu label Feb 9, 2026

depfu Bot closed this Apr 8, 2026

depfu Bot deleted the depfu/update/pnpm/axios-1.13.5 branch April 8, 2026 16:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update axios 1.12.2 → 1.13.5 (minor)#61

🚨 [security] Update axios 1.12.2 → 1.13.5 (minor)#61
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/pnpm/axios-1.13.5

depfu Bot commented Feb 9, 2026

Uh oh!

changeset-bot Bot commented Feb 9, 2026

Uh oh!

depfu Bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Conversation

depfu Bot commented Feb 9, 2026

What changed?

✳️ axios (1.12.2 → 1.13.5) · Repo · Changelog

🚨 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Denial of Service via proto Key in mergeConfig

Summary

Details

PoC

Impact

1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

1.13.4

Overview

What's New in v1.13.4

Bug Fixes

Infrastructure & CI/CD

Migration Notes

Breaking Changes

Deprecations

Contributors

1.13.3

Release notes:

Bug Fixes

Features

Reverts

Contributors to this release

1.13.2

Release notes:

Bug Fixes

Performance Improvements

Contributors to this release

1.13.1

Release notes:

Bug Fixes

Contributors to this release

1.13.0

Release notes:

Bug Fixes

Features

Contributors to this release

Uh oh!

changeset-bot Bot commented Feb 9, 2026

⚠️ No Changeset found

Uh oh!

depfu Bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

🚨 Axios is Vulnerable to Denial of Service via proto Key in mergeConfig