ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
CVE-2026-25639

Axios affected by Denial of Service via __proto__ Key in mergeConfig

CVSS 3.1 7.5 HIGHEUVD CVSS 3.1 7.5 CVSS 3.1 · [email protected] · Secondary 7.5 HIGHCVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5 HIGHCVSS_V3 Publisher rating HIGHFixed by axios 1.13.5Fixed by axios 0.30.3KEV status unknown
Original advisory

cve-program · CVE-2026-25639

Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Read the publisher's advisory

euvd · EUVD-2026-6850

Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Read the publisher's advisory

nvd · CVE-2026-25639

Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Read the publisher's advisory

osv · GHSA-43fc-jf86-j433

Published

# Denial of Service via **proto** Key in mergeConfig ### Summary The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service. ### Details The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101: ```javascript utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) { const merge = mergeMap[prop] || mergeDeepProperties; const configValue = merge(config1[prop], config2[prop], prop); (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue); }); ``` When `prop` is `'__proto__'`: 1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property 2. `Object.keys()` includes `'__proto__'` in the iteration 3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object) 4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype` 5. `Object.prototype(...)` throws `TypeError: merge is not a function` The `mergeConfig` function is called by: - `Axios._request()` at `lib/core/Axios.js:75` - `Axios.getUri()` at `lib/core/Axios.js:201` - All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224` ### PoC ```javascript import axios from "axios"; const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}'); await axios.get("https://httpbin.org/get", maliciousConfig); ``` **Reproduction steps:** 1. Clone axios repository or `npm install axios` 2. Create file `poc.mjs` with the code above 3. Run: `node poc.mjs` 4. Observe the TypeError crash **Verified output (axios 1.13.4):** ``` TypeError: merge is not a function at computeConfigValue (lib/core/mergeConfig.js:100:25) at Object.forEach (lib/utils.js:280:10) at mergeConfig (lib/core/mergeConfig.js:98:9) ``` **Control tests performed:** | Test | Config | Result | |------|--------|--------| | Normal config | `{"timeout": 5000}` | SUCCESS | | Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** | | Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS | **Attack scenario:** An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`. ### Impact **Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload. Affected environments: - Node.js servers using axios for HTTP requests - Any backend that passes parsed JSON to axios configuration This is NOT prototype pollution - the application crashes before any assignment occurs.

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-25639

Published

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Source published
9 Feb 2026 20:11:22 UTC
Source modified
10 Sep 2026 12:05:02 UTC
Saved here
23 Oct 2026 15:48:27 UTC
Source terms
CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-6850

Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property.…

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Feb 9, 2026, 8:11:22 PM

dateUpdated: Sep 10, 2026, 12:05:02 PM

50 related source bulletins · separate from aliases

RHSA-2026:13542: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.2 security update

CVE-2025-13465 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-68121 · CVE-2026-4740 · CVE-2026-22029 · CVE-2026-25639 · CVE-2026-29063 · CVE-2026-40175

RHSA-2026:7249: Red Hat Security Advisory: OpenShift Container Platform 4.19.28 bug fix and security update

CVE-2025-61726 · CVE-2025-61728 · CVE-2025-68121 · CVE-2026-25639 · CVE-2026-27959

RHSA-2026:6802: Red Hat Security Advisory: Red Hat Developer Hub 1.9.3 release.

CVE-2025-61140 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-2359 · CVE-2026-3304 · CVE-2026-3520 · CVE-2026-24046 · CVE-2026-25153 · CVE-2026-25639 · CVE-2026-25679 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-27606 · CVE-2026-27942 · CVE-2026-33186

RHSA-2026:6404: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

CVE-2025-69223 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-28498 · CVE-2026-28802 · CVE-2026-29074 · CVE-2026-30827 · CVE-2026-30922

RHSA-2026:8501: Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

CVE-2026-21441 · CVE-2026-25639 · CVE-2026-40175

RHSA-2026:6309: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

CVE-2025-69223 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-28498 · CVE-2026-28802 · CVE-2026-29074 · CVE-2026-30827 · CVE-2026-30922

WID-SEC-W-2026-2923: Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen

CVE-2019-13990 · CVE-2021-44906 · CVE-2022-1471 · CVE-2022-23521 · CVE-2022-3517 · CVE-2022-41903 · CVE-2023-22518 · CVE-2023-22522 · CVE-2023-22523 · CVE-2023-22524 · CVE-2023-22527 · CVE-2023-45133 · CVE-2023-46604 · CVE-2025-14813 · CVE-2026-0603 · CVE-2026-10050 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-12802 · CVE-2026-12803 · CVE-2026-12816 · CVE-2026-13149 · CVE-2026-13506 · CVE-2026-13676 · CVE-2026-14257 · CVE-2026-14682 · CVE-2026-16221 · CVE-2026-18446 · CVE-2026-21582 · CVE-2026-2332 · CVE-2026-24734 · CVE-2026-25639 · CVE-2026-27601 · CVE-2026-27606 · CVE-2026-29786 · CVE-2026-3505 · CVE-2026-40983 · CVE-2026-40984 · CVE-2026-41284 · CVE-2026-41842 · CVE-2026-41845 · CVE-2026-41850 · CVE-2026-41851 · CVE-2026-41907 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42041 · CVE-2026-42198 · CVE-2026-42583 · CVE-2026-42587 · CVE-2026-43513 · CVE-2026-44249 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44490 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-45416 · CVE-2026-45623 · CVE-2026-46625 · CVE-2026-47838 · CVE-2026-4800 · CVE-2026-48043 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-50010 · CVE-2026-53434 · CVE-2026-54291 · CVE-2026-54512 · CVE-2026-54513 · CVE-2026-55685 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56745 · CVE-2026-56819 · CVE-2026-58059 · CVE-2026-58060 · CVE-2026-59639 · CVE-2026-59642 · CVE-2026-59869 · CVE-2026-59871 · CVE-2026-59873 · CVE-2026-59874 · CVE-2026-59887 · CVE-2026-59901 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-67320 · CVE-2026-69152 · CVE-2026-69192

RHSA-2026:2694: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

CVE-2025-13465 · CVE-2025-14550 · CVE-2026-1207 · CVE-2026-1285 · CVE-2026-1287 · CVE-2026-1312 · CVE-2026-22029 · CVE-2026-24049 · CVE-2026-25639 · CVE-2026-26007

RHSA-2026:8500: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

CVE-2026-21441 · CVE-2026-25639 · CVE-2026-40175

RHSA-2026:11414: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.3 security update

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-68121 · CVE-2026-4740 · CVE-2026-25639 · CVE-2026-29063 · CVE-2026-40175

RHSA-2026:5636: Red Hat Security Advisory: multicluster engine for Kubernetes v2.7.9 security update

CVE-2025-13465 · CVE-2025-47907 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-68121 · CVE-2026-22029 · CVE-2026-25639

WID-SEC-W-2026-0881: IBM License Metric Tool: Mehrere Schwachstellen

CVE-2025-68161 · CVE-2026-22860 · CVE-2026-25500 · CVE-2026-25639

RHSA-2026:8499: Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image

CVE-2026-25639 · CVE-2026-40175

NCSC-2026-0325: Kwetsbaarheden verholpen in Atlassian producten

CVE-2021-44906 · CVE-2022-3517 · CVE-2023-45133 · CVE-2025-14813 · CVE-2026-0603 · CVE-2026-2332 · CVE-2026-3505 · CVE-2026-4800 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-10050 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-12802 · CVE-2026-12803 · CVE-2026-12816 · CVE-2026-13149 · CVE-2026-13506 · CVE-2026-13676 · CVE-2026-14257 · CVE-2026-14682 · CVE-2026-16221 · CVE-2026-18446 · CVE-2026-21582 · CVE-2026-24734 · CVE-2026-25639 · CVE-2026-27601 · CVE-2026-27606 · CVE-2026-29786 · CVE-2026-40983 · CVE-2026-40984 · CVE-2026-41284 · CVE-2026-41842 · CVE-2026-41845 · CVE-2026-41850 · CVE-2026-41851 · CVE-2026-41907 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42041 · CVE-2026-42198 · CVE-2026-42583 · CVE-2026-42587 · CVE-2026-43513 · CVE-2026-44249 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44490 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-45416 · CVE-2026-45623 · CVE-2026-46625 · CVE-2026-47838 · CVE-2026-48043 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-50010 · CVE-2026-53434 · CVE-2026-54291 · CVE-2026-54512 · CVE-2026-54513 · CVE-2026-55685 · CVE-2026-55831 · CVE-2026-55833 · CVE-2026-56745 · CVE-2026-56819 · CVE-2026-58059 · CVE-2026-58060 · CVE-2026-59639 · CVE-2026-59642 · CVE-2026-59869 · CVE-2026-59871 · CVE-2026-59873 · CVE-2026-59874 · CVE-2026-59887 · CVE-2026-59901 · CVE-2026-67320 · CVE-2026-69152 · CVE-2026-69192

RHSA-2026:3109: Red Hat Security Advisory: Kiali 2.17.4 for Red Hat OpenShift Service Mesh 3.2

CVE-2026-25639

RHSA-2026:25041: Red Hat Security Advisory: Red Hat Migration Toolkit for Containers

CVE-2026-25639 · CVE-2026-40175 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043 · CVE-2026-42044

RHSA-2026:6567: Red Hat Security Advisory: Red Hat Quay 3.16.3

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-68121 · CVE-2025-68158 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28498

RHSA-2026:8218: Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.5 security update

CVE-2025-13465 · CVE-2025-47907 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-68121 · CVE-2026-4740 · CVE-2026-22029 · CVE-2026-25639 · CVE-2026-29063

RHSA-2026:6308: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

CVE-2025-69223 · CVE-2026-1615 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007

RHSA-2026:5633: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.12.8 security update

CVE-2025-7195 · CVE-2025-13465 · CVE-2025-47907 · CVE-2025-58183 · CVE-2026-21721 · CVE-2026-22029 · CVE-2026-25639

RHSA-2026:5142: Red Hat Security Advisory: OpenShift Container Platform 4.20.17 bug fix and security update

CVE-2026-25639

RHSA-2026:19712: Red Hat Security Advisory: RHOAI 3.3.3 - Red Hat OpenShift AI

CVE-2025-6242 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-59057 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-62164 · CVE-2025-62718 · CVE-2025-64756 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66448 · CVE-2025-66471 · CVE-2025-69223 · CVE-2025-69873 · CVE-2026-0846 · CVE-2026-0847 · CVE-2026-4800 · CVE-2026-21441 · CVE-2026-21884 · CVE-2026-22029 · CVE-2026-22778 · CVE-2026-23490 · CVE-2026-23745 · CVE-2026-24049 · CVE-2026-24486 · CVE-2026-24779 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-27893 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29074 · CVE-2026-30922 · CVE-2026-31812 · CVE-2026-32597 · CVE-2026-32829 · CVE-2026-32981 · CVE-2026-33186 · CVE-2026-33231 · CVE-2026-33236 · CVE-2026-34986 · CVE-2026-40175 · CVE-2026-40192 · CVE-2026-40895

RHSA-2026:6568: Red Hat Security Advisory: Red Hat Quay 3.15.4

CVE-2024-34156 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-68121 · CVE-2025-68158 · CVE-2025-69873 · CVE-2026-4598 · CVE-2026-4599 · CVE-2026-4600 · CVE-2026-4601 · CVE-2026-4602 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28498 · CVE-2026-28802 · CVE-2026-29063 · CVE-2026-29074 · CVE-2026-30922 · CVE-2026-32597

RHSA-2026:4942: Red Hat Security Advisory: Red Hat Quay 3.12.15

CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-68121 · CVE-2026-24049 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28802

WID-SEC-W-2026-0935: Red Hat Ansible Automation Platform: Mehrere Schwachstellen

CVE-2025-69223 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-29074 · CVE-2026-30827 · CVE-2026-30922 · CVE-2026-26007 · CVE-2026-1615 · CVE-2026-28498 · CVE-2026-28802

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

RHSA-2026:41064: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update

CVE-2025-9288 · CVE-2025-13465 · CVE-2026-21721 · CVE-2026-22029 · CVE-2026-25639 · CVE-2026-42508 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-44990 · CVE-2026-46384 · CVE-2026-46385

RHSA-2026:6428: Red Hat Security Advisory: Network Observability 1.11.1 for OpenShift

CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-68121 · CVE-2026-25639 · CVE-2026-26960 · CVE-2026-29063 · CVE-2026-33186

RHSA-2026:6277: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

CVE-2025-61726 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-27904 · CVE-2026-29074

RHSA-2026:6192: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.

CVE-2025-13465 · CVE-2025-54386 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-64756 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-1002 · CVE-2026-22045 · CVE-2026-23745 · CVE-2026-23950 · CVE-2026-24049 · CVE-2026-24842 · CVE-2026-25223 · CVE-2026-25639 · CVE-2026-25949 · CVE-2026-26960 · CVE-2026-26996

RHSA-2026:3106: Red Hat Security Advisory: Kiali 2.4.13 for Red Hat OpenShift Service Mesh 3.0

CVE-2026-25639

WID-SEC-W-2026-1608: Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen

CVE-2019-13990 · CVE-2022-1471 · CVE-2022-23521 · CVE-2022-41903 · CVE-2023-22518 · CVE-2023-22522 · CVE-2023-22523 · CVE-2023-22524 · CVE-2023-22527 · CVE-2023-24998 · CVE-2023-46604 · CVE-2024-45801 · CVE-2025-52999 · CVE-2025-67030 · CVE-2026-22029 · CVE-2026-22732 · CVE-2026-24734 · CVE-2026-24880 · CVE-2026-25639 · CVE-2026-26960 · CVE-2026-27727 · CVE-2026-27830 · CVE-2026-29062 · CVE-2026-29129 · CVE-2026-29145 · CVE-2026-29146 · CVE-2026-29786 · CVE-2026-31802 · CVE-2026-33750 · CVE-2026-34483 · CVE-2026-34487 · CVE-2026-39304 · CVE-2026-42198 · CVE-2026-5598

RHSA-2026:86618: Red Hat Security Advisory: New container image: rhceph-9.2

CVE-2023-46159 · CVE-2024-47866 · CVE-2024-48916 · CVE-2024-55565 · CVE-2025-12816 · CVE-2025-15599 · CVE-2025-26791 · CVE-2025-30156 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-58754 · CVE-2025-59343 · CVE-2025-62718 · CVE-2025-66030 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69873 · CVE-2026-0540 · CVE-2026-21441 · CVE-2026-22610 · CVE-2026-25639 · CVE-2026-26996 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-27970 · CVE-2026-32141 · CVE-2026-33228 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-39865 · CVE-2026-40175 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-42033 · CVE-2026-42034 · CVE-2026-42035 · CVE-2026-42036 · CVE-2026-42037 · CVE-2026-42038 · CVE-2026-42039 · CVE-2026-42040 · CVE-2026-42041 · CVE-2026-42042 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-50152 · CVE-2026-58224

RHSA-2026:10184: Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI

CVE-2025-6242 · CVE-2025-11157 · CVE-2025-12103 · CVE-2025-14009 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-66418 · CVE-2025-66471 · CVE-2025-68131 · CVE-2025-69223 · CVE-2025-69227 · CVE-2025-69228 · CVE-2025-69534 · CVE-2026-0846 · CVE-2026-0847 · CVE-2026-1002 · CVE-2026-2472 · CVE-2026-2492 · CVE-2026-21441 · CVE-2026-22773 · CVE-2026-22807 · CVE-2026-24049 · CVE-2026-24281 · CVE-2026-24308 · CVE-2026-24486 · CVE-2026-24779 · CVE-2026-25223 · CVE-2026-25639 · CVE-2026-25679 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27137 · CVE-2026-27628 · CVE-2026-27888 · CVE-2026-27904 · CVE-2026-27959 · CVE-2026-28229 · CVE-2026-28356 · CVE-2026-30922 · CVE-2026-31837 · CVE-2026-31892 · CVE-2026-31958 · CVE-2026-32274 · CVE-2026-32597 · CVE-2026-32640 · CVE-2026-33236 · CVE-2026-33870 · CVE-2026-33871

RHSA-2026:13548: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.2 security update

CVE-2025-13465 · CVE-2025-58183 · CVE-2025-61726 · CVE-2026-4645 · CVE-2026-22029 · CVE-2026-25639 · CVE-2026-29063 · CVE-2026-32285 · CVE-2026-33186 · CVE-2026-33487 · CVE-2026-40175

RHSA-2026:5665: Red Hat Security Advisory: Red Hat Quay 3.10.19

CVE-2025-61726 · CVE-2025-61728 · CVE-2025-68121 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27606 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-27962 · CVE-2026-28802

RHSA-2026:5807: Red Hat Security Advisory: RHOAI 2.16.4 - Red Hat OpenShift AI

CVE-2024-25621 · CVE-2025-6193 · CVE-2025-12060 · CVE-2025-12638 · CVE-2025-12816 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66626 · CVE-2025-68156 · CVE-2025-69873 · CVE-2026-1526 · CVE-2026-1528 · CVE-2026-2229 · CVE-2026-25223 · CVE-2026-25639 · CVE-2026-29074 · CVE-2026-32141

RHSA-2026:6170: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.1

CVE-2025-66506 · CVE-2026-25639 · CVE-2026-33022 · CVE-2026-33211

RHSA-2026:9848: Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.10 security update

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-68121 · CVE-2026-4740 · CVE-2026-22029 · CVE-2026-25639 · CVE-2026-29063

RHSA-2026:3107: Red Hat Security Advisory: Kiali 1.73.27 for Red Hat OpenShift Service Mesh 2.6

CVE-2025-61729 · CVE-2026-25639

NCSC-2026-0381: Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise

CVE-2026-7598 · CVE-2026-25639 · CVE-2026-73954 · CVE-2026-73955 · CVE-2026-73960 · CVE-2026-82993 · CVE-2026-83014 · CVE-2026-83015 · CVE-2026-83016 · CVE-2026-83017 · CVE-2026-83018 · CVE-2026-83019 · CVE-2026-83070 · CVE-2026-87264

RHSA-2026:8229: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.6 security update

CVE-2025-13465 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61728 · CVE-2026-21721 · CVE-2026-22029 · CVE-2026-25639

RHSA-2026:36882: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update

CVE-2025-13465 · CVE-2025-47907 · CVE-2025-48431 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-62718 · CVE-2026-22029 · CVE-2026-22610 · CVE-2026-25639 · CVE-2026-25681 · CVE-2026-29063 · CVE-2026-32285 · CVE-2026-33186 · CVE-2026-33487 · CVE-2026-40175 · CVE-2026-40293 · CVE-2026-40895 · CVE-2026-41602 · CVE-2026-41603 · CVE-2026-41604 · CVE-2026-41605 · CVE-2026-41606 · CVE-2026-41607 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-43869 · CVE-2026-43870 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-44990

RHSA-2026:3087: Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

CVE-2025-13465 · CVE-2025-61729 · CVE-2025-66564 · CVE-2026-22029 · CVE-2026-25639

RHSA-2026:5174: Red Hat Security Advisory: OpenShift Container Platform 4.21.7 bug fix and security update

CVE-2026-25639

RHSA-2026:6174: Red Hat Security Advisory: Red Hat Developer Hub 1.8.5 release.

CVE-2025-61140 · CVE-2026-2359 · CVE-2026-3304 · CVE-2026-3520 · CVE-2026-24046 · CVE-2026-25153 · CVE-2026-25639 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-27606 · CVE-2026-27942 · CVE-2026-33186

WID-SEC-W-2026-0479: Red Hat OpenShift Service Mesh (Kiali): Schwachstelle ermöglicht Denial of Service

CVE-2026-25639

RHSA-2026:3105: Red Hat Security Advisory: Kiali 2.11.7 for Red Hat OpenShift Service Mesh 3.1

CVE-2026-25639

RHSA-2026:5168: Red Hat Security Advisory: Red Hat Quay 3.9.19

CVE-2025-61726 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28802

RHSA-2026:6497: Red Hat Security Advisory: Red Hat Quay 3.16.3

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-68121 · CVE-2025-68158 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28498

Source published
Feb 9, 2026, 8:11:22 PM (timezone not stated)
Source modified
Sep 10, 2026, 12:05:02 PM (timezone not stated)
Saved here
13 Nov 2026 07:05:37 UTC
Source terms
ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2026-25639

Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property.…

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-754 · CWE-1287

Original publisher date fields

published: 2026-02-09T21:15:49.010

lastModified: 2026-09-10T13:17:46.000

1 source CPE criteria · context only
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published
9 Feb 2026 21:15:49 UTC
Source modified
10 Sep 2026 13:17:46 UTC
Saved here
25 Oct 2026 06:17:16 UTC
Source terms
NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-43fc-jf86-j433

Published

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

# Denial of Service via **proto** Key in mergeConfig ### Summary The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service. ### Details The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101: ```javascript utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) { const merge = mergeMap[prop] || mergeDeepProperties; const configValue = merge(config1[prop], config2[prop], prop); (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue); }); ``` When `prop` is `'__proto__'`: 1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property 2. `Object.keys()` includes `'__proto__'` in the iteration 3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object) 4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype` 5. `Object.prototype(...)` throws `TypeError: merge is not a function` The `mergeConfig` function is called by: - `Axios._request()` at `lib/core/Axios.js:75` - `Axios.getUri()` at `lib/core/Axios.js:201` - All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224` ### PoC ```javascript import axios from "axios"; const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}'); await axios.get("https://httpbin.org/get", maliciousConfig); ``` **Reproduction steps:** 1. Clone axios repository or `npm install axios` 2. Create file `poc.mjs` with the code above 3. Run: `node poc.mjs` 4. Observe the TypeError crash **Verified output (axios 1.13.4):** ``` TypeError: merge is not a function at computeConfigValue (lib/core/mergeConfig.js:100:25) at Object.forEach (lib/utils.js:280:10) at mergeConfig (lib/core/mergeConfig.js:98:9) ``` **Control tests performed:** | Test | Config | Result | |------|--------|--------| | Normal config | `{"timeout": 5000}` | SUCCESS | | Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** | | Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS | **Attack scenario:** An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`. ### Impact **Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload. Affected environments: - Node.js servers using axios for HTTP requests - Any backend that passes parsed JSON to axios configuration This is NOT prototype pollution - the application crashes before any assignment occurs.

Source published
9 Feb 2026 17:46:14 UTC
Source modified
10 Sep 2026 03:50:34 UTC
Saved here
24 Oct 2026 13:17:17 UTC
Source terms
GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 04:55 UTC · 250 of 275 readable · 246 fully read · documentation 468/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.