Axios 0.24.x Release Notes

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/axios@0.24.0-axios-0.24.2

Security Fixes

• HTTP adapter: Enforce maxContentLength on streamed responses.
  • This fixes a medium-severity Uncontrolled Resource Consumption vulnerability (CVE-2026-42036).
• Config merging: Reject inherited validateStatus values when merging request configuration.
  • This fixes a medium severity Prototype Pollution authentication bypass vulnerability (CVE-2026-42041).
• NO_PROXY matching: Treat valid addresses in IPv4 127.0.0.0/8 as equivalent when an IPv4 loopback address is listed in NO_PROXY.
  • This fixes a high severity proxy bypass vulnerability (CVE-2026-42043).
• XHR adapter: Prevent withCredentials from sending XSRF cookie values in headers on cross-origin requests.
  • This fixes a medium severity Cross-Site Request Forgery (CSRF) vulnerability (CVE-2023-45857).
• Proxy handling: Treat localhost, 127.0.0.1, and ::1 as equivalent when evaluating NO_PROXY.
  • This fixes a medium severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-42038).
• URL resolution: Honor allowAbsoluteUrls: false when combining an absolute request URL with baseURL.
  • This fixes a high-severity Server-Side Request Forgery (SSRF) and credential leakage vulnerability (CVE-2025-27152).
• Cookie helper: Parse cookie names with exact string matching instead of a dynamically constructed regular expression.
  • This fixes a high-severity Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-44496).
• Proxy bypass: Fix NO_PROXY matching for IPv4-mapped IPv6 addresses so equivalent IPv4 exclusions bypass configured proxies.
  • This fixes a high severity proxy bypass vulnerability (CVE-2026-44492).
• Merge utility: Ignore inherited header buckets when recursively merging request configuration.
  • This fixes a medium-severity Prototype Pollution vulnerability (CVE-2026-44490).
• HTTP Basic authentication: Ignore inherited username and password values when building authorization headers.
  • This fixes a medium-severity Prototype Pollution vulnerability (CVE-2026-67319).
• HTTP adapter: Enforce maxBodyLength for streamed uploads when maxRedirects is 0.
  • This fixes a medium severity uncontrolled upload and resource exhaustion vulnerability (CVE-2026-42034).
• Request configuration: Ignore inherited security-sensitive options when merging request configuration or selecting the HTTP transport.
  • This fixes a high severity Prototype Pollution vulnerability (CVE-2026-42033).
  • This fixes a medium-severity Prototype Pollution vulnerability (CVE-2026-67316).
• Config merging: Ignore inherited transformResponse values when merging request config.
  • This fixes a high-severity credential exposure and response tampering vulnerability (CVE-2026-44495).
• Request headers: Sanitize invalid request-header characters before adapter dispatch.
  • This fixes a medium severity HTTP Request Smuggling vulnerability (CVE-2026-40175).
• XSRF requests: Require an own, strictly boolean withCredentials opt-in before sending the XSRF token cross-origin.
  • This fixes a medium severity sensitive information exposure vulnerability (CVE-2026-42042).
• Node.js HTTP adapter: Clear stale Proxy-Authorization header variants before reapplying the pinned proxy on HTTP-to-HTTPS redirects.
  • This fixes a high severity proxy credential exposure vulnerability (CVE-2026-44487).

Breaking Changes

XHR adapter

• Prevent withCredentials from sending XSRF cookie values in headers on cross-origin requests:
  Cross-origin requests with withCredentials: true no longer copy the XSRF cookie value into the XSRF request header automatically. This prevents credentials from being exposed to an untrusted origin.
  To preserve the previous behavior for a trusted cross-origin endpoint, explicitly set withXSRFToken: true.
  Before:

  axios.get('https://api.example.com/data', {
    withCredentials: true
  });
  
  
  After:

  axios.get('https://api.example.com/data', {
    withCredentials: true,
    withXSRFToken: true
  });
  

Proxy bypass

• Fix NO_PROXY matching for IPv4-mapped IPv6 addresses so equivalent IPv4 exclusions bypass configured proxies:
  Requests to an IPv4-mapped IPv6 destination now bypass the proxy when NO_PROXY contains the equivalent IPv4 address.
  Before:

  process.env.NO_PROXY = '127.0.0.1';
  axios.get('http://[::ffff:127.0.0.1]/'); // Uses the configured proxy.
  
  
  After:

  process.env.NO_PROXY = '127.0.0.1';
  axios.get('http://[::ffff:127.0.0.1]/'); // Bypasses the configured proxy.
  

Request headers

• Sanitize invalid request-header characters before adapter dispatch:
  Header values now have control characters and boundary whitespace removed before the request reaches an adapter. Previously, Node.js rejected such values while browser adapters could forward them.
  Before:

  axios.get('/', {
    headers: {'X-Test': ' ok\r\nInjected: yes\t'}
  });
  // Node.js rejects the value; browser adapters may forward it unchanged.
  
  
  After:

  axios.get('/', {
    headers: {'X-Test': ' ok\r\nInjected: yes\t'}
  });
  // Every adapter receives the sanitized value: 'okInjected: yes'.
  

XSRF requests

• Require an own, strictly boolean withCredentials opt-in before sending the XSRF token cross-origin:
  Truthy non-boolean and inherited withCredentials values no longer cause Axios to attach the XSRF token to cross-origin requests. Applications that intentionally send the token cross-origin must pass the boolean value true directly in the request configuration.
  Before:

  axios.get('https://api.example.com', {withCredentials: 1});
  
  
  After:

  axios.get('https://api.example.com', {withCredentials: true});