Axios 0.24.x Release Notes

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/axios@0.24.0-axios-0.24.4

Security Fixes

• NO_PROXY matching:
  • Normalize hostnames before checking NO_PROXY entries, so trailing-dot names (such as localhost.) and bracketed IPv6 addresses (such as [::1]) match their exclusions. Explicit ports, wildcard entries, and loopback aliases are also handled consistently.
    • This fixes a medium-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2025-62718).
• XHR adapter:
  • Honor withXSRFToken only when it is set directly on the request config, and require the boolean value true before sending the XSRF token cross-origin. Function values and explicit false behave as before.
    • This fixes a medium-severity Sensitive Information Exposure vulnerability (CVE-2026-42042).
• NO_PROXY matching:
  • Normalize dotted and hexadecimal IPv4-mapped IPv6 hosts (such as [::ffff:127.0.0.1] and [::ffff:7f00:1]) to IPv4 before comparing them with NO_PROXY entries, so equivalent IPv4 exclusions match. Port matching is preserved, and distinct IPv4 addresses stay separate.
    • This fixes a high-severity Proxy Bypass vulnerability (CVE-2026-44492).

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/axios@0.24.0-axios-0.24.3

Security Fixes

• Config merging:
  • Reject __proto__, constructor, and prototype keys before reading or recursively processing them in utils.merge.
    • This fixes a high-severity Denial of Service vulnerability (CVE-2026-25639).

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/axios@0.24.0-axios-0.24.2

Security Fixes

• HTTP adapter:
  • Enforce maxContentLength on streamed responses.
    • This fixes a medium-severity Uncontrolled Resource Consumption vulnerability (CVE-2026-42036).
• Config merging:
  • Reject inherited validateStatus values when merging request configuration.
    • This fixes a medium severity Prototype Pollution authentication bypass vulnerability (CVE-2026-42041).
• NO_PROXY matching:
  • Treat valid addresses in IPv4 127.0.0.0/8 as equivalent when an IPv4 loopback address is listed in NO_PROXY.
    • This fixes a high severity proxy bypass vulnerability (CVE-2026-42043).
• XHR adapter:
  • Prevent withCredentials from sending XSRF cookie values in headers on cross-origin requests.
    • This fixes a medium severity Cross-Site Request Forgery (CSRF) vulnerability (CVE-2023-45857).
• Proxy handling:
  • Treat localhost, 127.0.0.1, and ::1 as equivalent when evaluating no_proxy.
    • This fixes a medium severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-42038).
• URL resolution:
  • Honor allowAbsoluteUrls: false when combining an absolute request URL with baseURL.
    • This fixes a high-severity Server-Side Request Forgery (SSRF) and credential leakage vulnerability (CVE-2025-27152).
• Cookie helper:
  • Parse cookie names with exact string matching instead of a dynamically constructed regular expression.
    • This fixes a high-severity Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-44496).
• Proxy bypass:
  • Fix NO_PROXY matching for IPv4-mapped IPv6 addresses so equivalent IPv4 exclusions bypass configured proxies.
    • This fixes a high severity proxy bypass vulnerability (CVE-2026-44492).
• Merge utility:
  • Ignore inherited header buckets when recursively merging request configuration.
    • This fixes a medium-severity Prototype Pollution vulnerability (CVE-2026-44490).
• HTTP Basic authentication:
  • Ignore inherited username and password values when building authorization headers.
    • This fixes a medium-severity Prototype Pollution vulnerability (CVE-2026-67319).
• HTTP adapter:
  • Enforce maxBodyLength for streamed uploads when maxRedirects is 0.
    • This fixes a medium severity uncontrolled upload and resource exhaustion vulnerability (CVE-2026-42034).
• Request configuration:
  • Ignore inherited security-sensitive options when merging request configuration or selecting the HTTP transport.
    • This fixes a high severity Prototype Pollution vulnerability (CVE-2026-42033).
    • This fixes a medium-severity Prototype Pollution vulnerability (CVE-2026-67316).
• Config merging:
  • Ignore inherited transformResponse values when merging request config.
    • This fixes a high-severity credential exposure and response tampering vulnerability (CVE-2026-44495).
• Request headers:
  • Sanitize invalid request-header characters before adapter dispatch.
    • This fixes a medium severity HTTP Request Smuggling vulnerability (CVE-2026-40175).
• XSRF requests:
  • Require an own, strictly boolean withCredentials opt-in before sending the XSRF token cross-origin.
    • This fixes a medium severity sensitive information exposure vulnerability (CVE-2026-42042).
• Node.js HTTP adapter:
  • Clear stale Proxy-Authorization header variants before reapplying the pinned proxy on HTTP-to-HTTPS redirects.
    • This fixes a high severity proxy credential exposure vulnerability (CVE-2026-44487).

Breaking Changes

XHR adapter

• Prevent withCredentials from sending XSRF cookie values in headers on cross-origin requests:
  Cross-origin requests with withCredentials: true no longer copy the XSRF cookie value into the XSRF request header automatically. This prevents credentials from being exposed to an untrusted origin.
  To preserve the previous behavior for a trusted cross-origin endpoint, explicitly set withXSRFToken: true.
  Before:

  axios.get('https://api.example.com/data', {
    withCredentials: true
  });
  
  
  After:

  axios.get('https://api.example.com/data', {
    withCredentials: true,
    withXSRFToken: true
  });
  

Proxy bypass

• Fix NO_PROXY matching for IPv4-mapped IPv6 addresses so equivalent IPv4 exclusions bypass configured proxies.
  Requests to an IPv4-mapped IPv6 destination now bypass the proxy when NO_PROXY contains the equivalent IPv4 address.
  Before:

  process.env.NO_PROXY = '127.0.0.1';
  axios.get('http://[::ffff:127.0.0.1]/'); // Uses the configured proxy.
  
  
  After:

  process.env.NO_PROXY = '127.0.0.1';
  axios.get('http://[::ffff:127.0.0.1]/'); // Bypasses the configured proxy.
  

Request headers

• Sanitize invalid request-header characters before adapter dispatch:
  Header values now have control characters and boundary whitespace removed before the request reaches an adapter. Previously, Node.js rejected such values while browser adapters could forward them.
  Before:

  axios.get('/', {
    headers: {'X-Test': ' ok\r\nInjected: yes\t'}
  });
  // Node.js rejects the value; browser adapters may forward it unchanged.
  
  
  After:

  axios.get('/', {
    headers: {'X-Test': ' ok\r\nInjected: yes\t'}
  });
  // Every adapter receives the sanitized value: 'okInjected: yes'.
  

XSRF requests

• Require an own, strictly boolean withCredentials opt-in before sending the XSRF token cross-origin.
  Truthy non-boolean and inherited withCredentials values no longer cause Axios to attach the XSRF token to cross-origin requests. Applications that intentionally send the token cross-origin must pass the boolean value true directly in the request configuration.
  Before:

  axios.get('https://api.example.com', {withCredentials: 1});
  
  
  After:

  axios.get('https://api.example.com', {withCredentials: true});