CVE-2026-25639: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25639 is a Denial of Service (DoS) vulnerability in the Axios HTTP client library for Node.js, caused by improper handling of __proto__ as an own property in the mergeConfig function. When a configuration object containing __proto__ (created via JSON.parse()) is passed to any Axios HTTP method, the library crashes with a TypeError, causing complete service unavailability. The vulnerability affects Axios versions prior to 0.30.3 (0.x branch) and prior to 1.13.5 (1.x branch). It was disclosed on February 8, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). The flaw exists in lib/core/mergeConfig.js at lines 98–101, where Object.keys({ ...config1, ...config2 }) is iterated without filtering dangerous prototype-related keys. When __proto__ appears as an own enumerable property (as produced by JSON.parse('{ "__proto__": {...} }')), the lookup mergeMap['__proto__'] traverses the prototype chain and returns Object.prototype — a truthy non-function object. The subsequent call Object.prototype(...) throws TypeError: merge is not a function, crashing the Node.js process. This code path is triggered by all Axios HTTP method shortcuts (get, post, etc.), Axios._request(), and Axios.getUri(). Importantly, this is not prototype pollution — the crash occurs before any property assignment (GitHub Advisory, Fix Commit).

Successful exploitation results in a complete crash of any Node.js application that accepts user-controlled JSON, parses it with JSON.parse(), and passes the result to Axios configuration methods. The impact is limited to availability — there is no confidentiality or integrity impact. Applications relying on Axios for outbound HTTP requests (e.g., API gateways, backend services, microservices) would become entirely unresponsive, potentially causing cascading failures in dependent systems. The vulnerability has a broad downstream footprint, affecting numerous IBM enterprise products (including IBM Maximo Application Suite, IBM API Connect, IBM Cloud Pak for Business Automation, IBM watsonx Orchestrate, and others), Atlassian products, Splunk User Behavior Analytics, Red Hat packages, and HPE products (GitHub Advisory, IBM Advisory).

A public proof-of-concept (PoC) is available in the official GitHub security advisory, requiring only a few lines of JavaScript to reproduce the crash (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction — any network-accessible endpoint that passes user-supplied JSON to Axios is exploitable. The EPSS score is approximately 0.046% (15th percentile), indicating low current exploitation probability. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify Node.js applications that accept user-controlled JSON input and use Axios for HTTP requests. Look for API endpoints that accept JSON bodies and pass them (or parts of them) to Axios configuration parameters such as headers, params, or the config object directly.
2. Craft malicious payload: Construct a JSON payload containing __proto__ as a top-level key: {"__proto__": {"x": 1}}. This creates an object with __proto__ as an own enumerable property when parsed with JSON.parse().
3. Deliver payload: Submit the malicious JSON to the target endpoint via an HTTP request (e.g., POST /api/endpoint with Content-Type: application/json and body {"__proto__": {"x": 1}}).
4. Trigger crash: If the application passes the parsed JSON object (or a derivative) to any Axios method as a config parameter — e.g., axios.get(url, userConfig) — the mergeConfig function will encounter __proto__ during key iteration, attempt to call Object.prototype as a function, and throw TypeError: merge is not a function.
5. Achieve DoS: The unhandled TypeError crashes the Node.js process or request handler, making the service unavailable. Repeated requests sustain the denial of service (GitHub Advisory).

• Logs: Node.js application logs showing TypeError: merge is not a function with stack traces referencing computeConfigValue (lib/core/mergeConfig.js:100), Object.forEach (lib/utils.js:280), and mergeConfig (lib/core/mergeConfig.js:98).
• Logs: Repeated application crashes or process restarts (e.g., PM2, systemd, or container orchestrator restart events) correlated with specific inbound HTTP requests.
• Network: Inbound HTTP requests containing JSON bodies with __proto__ as a top-level key (detectable via WAF or API gateway request logging).
• Application Behavior: Sudden service unavailability or elevated error rates (HTTP 500 or connection refused) on endpoints that accept JSON input and use Axios internally.

Upgrade Axios to version 1.13.5 (for the 1.x branch) or 0.30.3 (for the 0.x branch), which add explicit filtering of __proto__, constructor, and prototype keys in mergeConfig and utils.merge (GitHub Advisory, Fix Commit). As a workaround for applications that cannot immediately patch, validate and sanitize user-supplied JSON before passing it to Axios — specifically, reject or strip any object containing __proto__, constructor, or prototype as keys. Downstream product users should apply vendor-specific patches: IBM has released fixes across numerous affected products (Maximo, API Connect, Cloud Pak, watsonx, etc.), Splunk released SVD-2026-0515, Atlassian issued bulletins in March, April, and May 2026, and Red Hat has published multiple errata (e.g., RHSA-2026:2694, RHSA-2026:3087, RHSA-2026:3109).

The vulnerability received moderate coverage from security news outlets shortly after disclosure, with articles from SecurityOnline.info, CyberSecurityNews, IT Security News, and Security Boulevard highlighting the DoS risk to Node.js servers (SecurityOnline, CyberSecurityNews). The Hacker News included it in a weekly recap, and Cyble featured it in their weekly vulnerability report. Striga.ai published a technical deep-dive titled "Crashing Axios with __proto__" (Striga Research). Community reaction on GitHub was active, with numerous dependent projects (including Azure LogicAppsUX, Kolibri, and others) quickly merging Dependabot PRs to upgrade Axios. The axios maintainer (jasonsaayman) responded promptly, merging the fix on February 4, 2026, and the 0.x backport was contributed by community member FeBe95 on February 18, 2026.