# Axios 0.24.x Release Notes > Comprehensive release notes and changelog for Axios 0.24.x, including security patches, bug fixes, and feature updates across all supported versions. ### v0.24.4 - September 30, 2026 #### Notes - **Full package name(s) and version(s):** - `@neverendingsupport/axios@0.24.0-axios-0.24.4` #### Security Fixes - **NO_PROXY matching:** - Normalize hostnames before checking `NO_PROXY` entries, so trailing-dot names (such as `localhost.`) and bracketed IPv6 addresses (such as `[::1]`) match their exclusions. Explicit ports, wildcard entries, and loopback aliases are also handled consistently. - This fixes a medium-severity Server-Side Request Forgery (SSRF) vulnerability ([CVE-2025-62718](https://www.herodevs.com/vulnerability-directory/cve-2025-62718)). - **XHR adapter:** - Honor `withXSRFToken` only when it is set directly on the request config, and require the boolean value `true` before sending the XSRF token cross-origin. Function values and explicit `false` behave as before. - This fixes a medium-severity Sensitive Information Exposure vulnerability ([CVE-2026-42042](https://www.herodevs.com/vulnerability-directory/cve-2026-42042)). - **NO_PROXY matching:** - Normalize dotted and hexadecimal IPv4-mapped IPv6 hosts (such as `[::ffff:127.0.0.1]` and `[::ffff:7f00:1]`) to IPv4 before comparing them with `NO_PROXY` entries, so equivalent IPv4 exclusions match. Port matching is preserved, and distinct IPv4 addresses stay separate. - This fixes a high-severity Proxy Bypass vulnerability ([CVE-2026-44492](https://www.herodevs.com/vulnerability-directory/cve-2026-44492)). ### v0.24.3 - September 18, 2026 #### Notes - **Full package name(s) and version(s):** - `@neverendingsupport/axios@0.24.0-axios-0.24.3` #### Security Fixes - **Config merging:** - Reject `__proto__`, `constructor`, and `prototype` keys before reading or recursively processing them in `utils.merge`. - This fixes a high-severity Denial of Service vulnerability ([CVE-2026-25639](https://www.herodevs.com/vulnerability-directory/cve-2026-25639)). ### v0.24.2 - August 28, 2026 #### Notes - **Full package name(s) and version(s):** - `@neverendingsupport/axios@0.24.0-axios-0.24.2` #### Security Fixes - **HTTP adapter:** - Enforce `maxContentLength` on streamed responses. - This fixes a medium-severity Uncontrolled Resource Consumption vulnerability ([CVE-2026-42036](https://www.herodevs.com/vulnerability-directory/cve-2026-42036)). - **Config merging:** - Reject inherited `validateStatus` values when merging request configuration. - This fixes a medium severity Prototype Pollution authentication bypass vulnerability ([CVE-2026-42041](https://www.herodevs.com/vulnerability-directory/cve-2026-42041)). - **NO_PROXY matching:** - Treat valid addresses in IPv4 `127.0.0.0/8` as equivalent when an IPv4 loopback address is listed in `NO_PROXY`. - This fixes a high severity proxy bypass vulnerability ([CVE-2026-42043](https://www.herodevs.com/vulnerability-directory/cve-2026-42043)). - **XHR adapter:** - Prevent `withCredentials` from sending XSRF cookie values in headers on cross-origin requests. - This fixes a medium severity Cross-Site Request Forgery (CSRF) vulnerability ([CVE-2023-45857](https://www.herodevs.com/vulnerability-directory/cve-2023-45857)). - **Proxy handling:** - Treat `localhost`, `127.0.0.1`, and `::1` as equivalent when evaluating `no_proxy`. - This fixes a medium severity Server-Side Request Forgery (SSRF) vulnerability ([CVE-2026-42038](https://www.herodevs.com/vulnerability-directory/cve-2026-42038)). - **URL resolution:** - Honor `allowAbsoluteUrls: false` when combining an absolute request URL with `baseURL`. - This fixes a high-severity Server-Side Request Forgery (SSRF) and credential leakage vulnerability ([CVE-2025-27152](https://www.herodevs.com/vulnerability-directory/cve-2025-27152)). - **Cookie helper:** - Parse cookie names with exact string matching instead of a dynamically constructed regular expression. - This fixes a high-severity Regular Expression Denial of Service (ReDoS) vulnerability ([CVE-2026-44496](https://www.herodevs.com/vulnerability-directory/cve-2026-44496)). - **Proxy bypass:** - Fix `NO_PROXY` matching for IPv4-mapped IPv6 addresses so equivalent IPv4 exclusions bypass configured proxies. - This fixes a high severity proxy bypass vulnerability ([CVE-2026-44492](https://www.herodevs.com/vulnerability-directory/cve-2026-44492)). - **Merge utility:** - Ignore inherited header buckets when recursively merging request configuration. - This fixes a medium-severity Prototype Pollution vulnerability ([CVE-2026-44490](https://www.herodevs.com/vulnerability-directory/cve-2026-44490)). - **HTTP Basic authentication:** - Ignore inherited `username` and `password` values when building authorization headers. - This fixes a medium-severity Prototype Pollution vulnerability ([CVE-2026-67319](https://www.herodevs.com/vulnerability-directory/cve-2026-67319)). - **HTTP adapter:** - Enforce `maxBodyLength` for streamed uploads when `maxRedirects` is `0`. - This fixes a medium severity uncontrolled upload and resource exhaustion vulnerability ([CVE-2026-42034](https://www.herodevs.com/vulnerability-directory/cve-2026-42034)). - **Request configuration:** - Ignore inherited security-sensitive options when merging request configuration or selecting the HTTP transport. - This fixes a high severity Prototype Pollution vulnerability ([CVE-2026-42033](https://www.herodevs.com/vulnerability-directory/cve-2026-42033)). - This fixes a medium-severity Prototype Pollution vulnerability ([CVE-2026-67316](https://www.herodevs.com/vulnerability-directory/cve-2026-67316)). - **Config merging:** - Ignore inherited `transformResponse` values when merging request config. - This fixes a high-severity credential exposure and response tampering vulnerability ([CVE-2026-44495](https://www.herodevs.com/vulnerability-directory/cve-2026-44495)). - **Request headers:** - Sanitize invalid request-header characters before adapter dispatch. - This fixes a medium severity HTTP Request Smuggling vulnerability ([CVE-2026-40175](https://www.herodevs.com/vulnerability-directory/cve-2026-40175)). - **XSRF requests:** - Require an own, strictly boolean `withCredentials` opt-in before sending the XSRF token cross-origin. - This fixes a medium severity sensitive information exposure vulnerability ([CVE-2026-42042](https://www.herodevs.com/vulnerability-directory/cve-2026-42042)). - **Node.js HTTP adapter:** - Clear stale `Proxy-Authorization` header variants before reapplying the pinned proxy on HTTP-to-HTTPS redirects. - This fixes a high severity proxy credential exposure vulnerability ([CVE-2026-44487](https://www.herodevs.com/vulnerability-directory/cve-2026-44487)). #### Breaking Changes ##### **XHR adapter** - **Prevent withCredentials from sending XSRF cookie values in headers on cross-origin requests:**
Cross-origin requests with `withCredentials: true` no longer copy the XSRF cookie value into the XSRF request header automatically. This prevents credentials from being exposed to an untrusted origin.
To preserve the previous behavior for a trusted cross-origin endpoint, explicitly set `withXSRFToken: true`.
**Before:**```js axios.get('https://api.example.com/data', { withCredentials: true }); ```
**After:**```js axios.get('https://api.example.com/data', { withCredentials: true, withXSRFToken: true }); ``` ##### **Proxy bypass** - **Fix NO_PROXY matching for IPv4-mapped IPv6 addresses so equivalent IPv4 exclusions bypass configured proxies.**
Requests to an IPv4-mapped IPv6 destination now bypass the proxy when `NO_PROXY` contains the equivalent IPv4 address.
**Before:**```js process.env.NO_PROXY = '127.0.0.1'; axios.get('http://[::ffff:127.0.0.1]/'); // Uses the configured proxy. ```
**After:**```js process.env.NO_PROXY = '127.0.0.1'; axios.get('http://[::ffff:127.0.0.1]/'); // Bypasses the configured proxy. ``` ##### **Request headers** - **Sanitize invalid request-header characters before adapter dispatch:**
Header values now have control characters and boundary whitespace removed before the request reaches an adapter. Previously, Node.js rejected such values while browser adapters could forward them.
**Before:**```js axios.get('/', { headers: {'X-Test': ' ok\r\nInjected: yes\t'} }); // Node.js rejects the value; browser adapters may forward it unchanged. ```
**After:**```js axios.get('/', { headers: {'X-Test': ' ok\r\nInjected: yes\t'} }); // Every adapter receives the sanitized value: 'okInjected: yes'. ``` ##### **XSRF requests** - **Require an own, strictly boolean withCredentials opt-in before sending the XSRF token cross-origin.**
Truthy non-boolean and inherited `withCredentials` values no longer cause Axios to attach the XSRF token to cross-origin requests. Applications that intentionally send the token cross-origin must pass the boolean value `true` directly in the request configuration.
**Before:**```js axios.get('https://api.example.com', {withCredentials: 1}); ```
**After:**```js axios.get('https://api.example.com', {withCredentials: true}); ``` ### v0.24.1 - August 27, 2026 #### Notes - This release contains no functional change from the **OSS axios v0.24.0**. - This release mainlines **OSS v0.24.0** into **NES v0.24.1**. - **Full package name(s) and version(s):** - `@neverendingsupport/axios@0.24.0-axios-0.24.1`