CVE-2026-25639

A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

This vulnerability is rated as having an Important severity because an unauthenticated remote attacker can trigger an unhandled process crash in backend services that merge untrusted JSON input into HTTP request configurations, resulting in denial of service. While Axios is widely distributed across Red Hat products and container images, exploitation is constrained to server-side Node.js applications that dynamically feed externally supplied configuration dictionaries into Axios methods. Browser-based frontends and deployments relying solely on static configuration parameters are unaffected by persistent service disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.