CVE-2026-25639

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS 2%

Published 2026-02-09Updated 2026-02-09

Media 892

Vulnerability details

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNAGitHub_M

EPSS score history

Sources

6 links

PoC links are not available for guest users. Login to view them.

CVEShield CVE Organization RedHat Vuln DB The Hacker News NVD Analysis The Hacker News

Profile

CVSS

7.5

EPSS

Published

2026-02-09

Updated

2026-02-09

CNA

GitHub_M

Vendors

axios

1 product

CPEs

cpe:/a:redhat:ansible_automation_platform:2.6::el9

cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9

cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9

cpe:/a:redhat:network_observ_optr:1.11::el9

cpe:/a:redhat:acm:2.12::el9

cpe:/a:redhat:acm:2.13::el9

cpe:/a:redhat:acm:2.15::el9

cpe:/a:redhat:ansible_automation_platform:2.5::el8

cpe:/a:redhat:rhdh:1.8::el9

cpe:/a:redhat:rhdh:1.9::el9

cpe:/a:redhat:discovery:2::el9

cpe:/a:redhat:rhmt:1.8::el8

cpe:/a:redhat:openshift_ai:2.16::el8

cpe:/a:redhat:openshift_ai:2.25::el9

cpe:/a:redhat:openshift_ai:3.3::el9

cpe:/a:redhat:openshift:4.19::el9

cpe:/a:redhat:openshift:4.20::el9

cpe:/a:redhat:openshift:4.21::el9

cpe:/a:redhat:openshift_devspaces:3.27::el9

cpe:/a:redhat:openshift_pipelines:1.21::el9

cpe:/a:redhat:service_mesh:2.6::el8

cpe:/a:redhat:service_mesh:3.0::el9

cpe:/a:redhat:service_mesh:3.1::el9

cpe:/a:redhat:service_mesh:3.2::el9

cpe:/a:redhat:quay:3.12::el8

cpe:/a:redhat:quay:3.15::el8

cpe:/a:redhat:quay:3.16::el9

cpe:/a:redhat:quay:3.10::el8

cpe:/a:redhat:quay:3.9::el8

cpe:/a:redhat:satellite:6.18::el9

cpe:/a:redhat:trusted_artifact_signer:1.3::el9

cpe:/a:redhat:multicluster_engine:2.10::el9

cpe:/a:redhat:multicluster_engine:2.6::el9

cpe:/a:redhat:multicluster_engine:2.7::el9

cpe:/a:redhat:multicluster_engine:2.8::el9

cpe:/a:redhat:multicluster_engine:2.9::el9

cpe:/a:redhat:logging:5

cpe:/a:redhat:migration_toolkit_applications:8

cpe:/a:redhat:openshift_pipelines:1

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:podman_desktop:0

cpe:/a:redhat:enterprise_linux_ai:3

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:openshift:4

cpe:/a:redhat:container_native_virtualization:4

cpe:/a:redhat:trusted_profile_analyzer:2

cpe:/a:redhat:ansible_portal:2

cpe:/a:redhat:amq_streams:3

cpe:/a:redhat:ansible_automation_platform:2.6::el10

cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:gatekeeper:3

cpe:/a:redhat:service_mesh:3

cpe:/a:redhat:advanced_cluster_security:4

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:kueue_operator:1

cpe:/a:redhat:jboss_data_grid:8

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift_devspaces:3

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:trusted_artifact_signer:1

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:acm:2.14::el9

cpe:/a:redhat:acm:2.11::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated