chore(deps): update dependency axios to v1.13.5 [security] - abandoned by renovate[bot] · Pull Request #1853 · launchdarkly/launchpad-ui

renovate · 2026-02-11T18:22:16Z

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.12.2` → `1.13.5`

GitHub Vulnerability Alerts

CVE-2026-25639

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Release Notes

axios/axios (axios)

`v1.13.5`

Compare Source

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)
Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)
Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)
Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)
CI: update workflow YAMLs. (PR #7372)
CI: fix run condition. (PR #7373)
Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)
@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

`v1.13.4`

Compare Source

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)
- Fixed issues discovered in v1.13.3 release
- Cleaned up interceptor test files
- Improved workflow configurations

Infrastructure & CI/CD

refactor: ci and build (#7340) (8ff6c19)
- Major refactoring of CI/CD workflows
- Consolidated workflow files for better maintainability
- Added mise configuration for the development environment
- Improved sponsor block update automation
- Enhanced issue and PR templates
- Added automatic release notes generation
- Implemented workflow cancellation for concurrent runs
chore: codegen and some updates to workflows (76cf77b)
- Code generation improvements
- Workflow optimisations

Migration Notes

Breaking Changes

None in this release.

Deprecations

None in this release.

Contributors

Thank you to all contributors who made this release possible! Special thanks to:

jasonsaayman - Release management and CI/CD improvements

`v1.13.3`

Compare Source

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
interceptor: handle the error in the same interceptor (#6269) (5945e40)
main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)
add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
added copilot instructions (3f83143)
compatibility with frozen prototypes (#6265) (860e033)
enhance pipeFileToResponse with error handling (#7169) (88d7884)
types: Intellisense for string literals in a widened union (#6134) (f73474d), closes /github.com/microsoft/TypeScript/issues/33471#issuecomment-1376364329

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

`v1.13.2`

Compare Source

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

`v1.13.1`

Compare Source

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

`v1.13.0`

Compare Source

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

types: fixed env config types; (#7020) (b5f26b7)

Contributors to this release

Dmitriy Mozgovoy

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-02-11T18:22:21Z

⚠️ No Changeset found

Latest commit: 07415a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-02-11T18:24:03Z

Size Change: 0 B

Total Size: 533 kB

ℹ️ View Unchanged

Filename	Size
`apps/vscode/dist/client.js`	111 kB
`apps/vscode/dist/server.js`	261 kB
`packages/box/dist/index.es.js`	7.26 kB
`packages/box/dist/index.js`	7.82 kB
`packages/box/dist/style.css`	2.67 kB
`packages/button/dist/index.es.js`	1.89 kB
`packages/button/dist/index.js`	2.32 kB
`packages/button/dist/style.css`	3 kB
`packages/components/dist/index.es.js`	19.1 kB
`packages/components/dist/index.js`	20 kB
`packages/components/dist/style.css`	8.45 kB
`packages/core/dist/index.es.js`	512 B
`packages/core/dist/index.js`	1.27 kB
`packages/drawer/dist/index.es.js`	1.76 kB
`packages/drawer/dist/index.js`	2.22 kB
`packages/drawer/dist/style.css`	497 B
`packages/dropdown/dist/index.es.js`	1.15 kB
`packages/dropdown/dist/index.js`	1.59 kB
`packages/filter/dist/index.es.js`	2.23 kB
`packages/filter/dist/index.js`	2.68 kB
`packages/filter/dist/style.css`	881 B
`packages/focus-trap/dist/index.es.js`	418 B
`packages/focus-trap/dist/index.js`	852 B
`packages/form/dist/index.es.js`	4.25 kB
`packages/form/dist/index.js`	4.73 kB
`packages/form/dist/style.css`	2.21 kB
`packages/icons/dist/index.es.js`	2.91 kB
`packages/icons/dist/index.js`	3.34 kB
`packages/icons/dist/style.css`	532 B
`packages/menu/dist/index.es.js`	3.69 kB
`packages/menu/dist/index.js`	4.16 kB
`packages/menu/dist/style.css`	872 B
`packages/modal/dist/index.es.js`	3.08 kB
`packages/modal/dist/index.js`	3.55 kB
`packages/modal/dist/style.css`	903 B
`packages/navigation/dist/index.es.js`	2.75 kB
`packages/navigation/dist/index.js`	3.21 kB
`packages/navigation/dist/style.css`	874 B
`packages/overlay/dist/index.es.js`	1.02 kB
`packages/overlay/dist/index.js`	1.42 kB
`packages/popover/dist/index.es.js`	3.01 kB
`packages/popover/dist/index.js`	3.43 kB
`packages/popover/dist/style.css`	529 B
`packages/portal/dist/index.es.js`	420 B
`packages/portal/dist/index.js`	835 B
`packages/table/dist/index.es.js`	1.01 kB
`packages/table/dist/index.js`	1.44 kB
`packages/table/dist/style.css`	700 B
`packages/tokens/dist/fonts.css`	183 B
`packages/tokens/dist/index.css`	1.47 kB
`packages/tokens/dist/index.es.js`	3.07 kB
`packages/tokens/dist/index.js`	3.11 kB
`packages/tokens/dist/media-queries.css`	113 B
`packages/tokens/dist/themes.css`	2.27 kB
`packages/tooltip/dist/index.es.js`	598 B
`packages/tooltip/dist/index.js`	1.02 kB
`packages/tooltip/dist/style.css`	337 B
`packages/vars/dist/index.es.js`	2.66 kB
`packages/vars/dist/index.js`	2.66 kB

_{compressed-size-action}

renovate · 2026-02-18T20:41:20Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

chore(deps): update dependency axios to v1.13.5 [security]

1bb2d2c

renovate Bot requested a review from a team as a code owner February 11, 2026 18:22

Merge branch 'main' into renovate/npm-axios-vulnerability

07415a3

renovate Bot changed the title ~~chore(deps): update dependency axios to v1.13.5 [security]~~ chore(deps): update dependency axios to v1.13.5 [security] - abandoned Feb 18, 2026

zmdavis approved these changes Feb 18, 2026

View reviewed changes

zmdavis merged commit f1dfd76 into main Feb 18, 2026
16 checks passed

zmdavis deleted the renovate/npm-axios-vulnerability branch February 18, 2026 21:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency axios to v1.13.5 [security] - abandoned#1853

chore(deps): update dependency axios to v1.13.5 [security] - abandoned#1853
zmdavis merged 2 commits into
mainfrom
renovate/npm-axios-vulnerability

renovate Bot commented Feb 11, 2026

Uh oh!

changeset-bot Bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Feb 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Feb 11, 2026

GitHub Vulnerability Alerts

CVE-2026-25639

Denial of Service via proto Key in mergeConfig

Summary

Details

PoC

Impact

Release Notes

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

v1.13.4

Overview

What's New in v1.13.4

Bug Fixes

Infrastructure & CI/CD

Migration Notes

Breaking Changes

Deprecations

Contributors

v1.13.3

Bug Fixes

Features

Reverts

Contributors to this release

v1.13.2

Bug Fixes

Performance Improvements

Contributors to this release

v1.13.1

Bug Fixes

Contributors to this release

v1.13.0

Bug Fixes

Features

Contributors to this release

1.12.2 (2025-09-14)

Bug Fixes

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

Contributors to this release

Configuration

Uh oh!

changeset-bot Bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Feb 18, 2026

Autoclosing Skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v1.13.5`

`v1.13.4`

`v1.13.3`

`v1.13.2`

`v1.13.1`

`v1.13.0`

changeset-bot Bot commented Feb 11, 2026 •

edited

Loading

github-actions Bot commented Feb 11, 2026 •

edited

Loading