Axios CVE-2026-25639: Single JSON Key Crashes Node.js Servers — CVSS 7.5 Prototype Pollution in World's Most Popular HTTP Client
Striga AI / Hacker News·medium signal
CVE-2026-25639 (CVSS 7.5) allows a single malicious JSON payload containing a __proto__ key to crash any Node.js server using Axios for request configuration. The vulnerability in mergeConfig causes a TypeError when Object.prototype is invoked as a function, crashing the process before any assignment occurs. Axios is the most downloaded HTTP client on npm. Fix available in versions 0.30.3 and 1.13.5+. The research was presented by Striga AI and has 10 points on HN.