Axios, a promise based HTTP client for browsers and Node.js, has a flaw in its mergeConfig function where passing a configuration object with an own __proto__ property causes a TypeError crash. This results in a complete denial of service for the application process that uses Axios. The weakness is a combination of improper handling of prototype properties (CWE-1287) and unvalidated merge logic (CWE-754).

All Axios users running a version earlier than 0.30.3 or 1.13.5 are vulnerable. This includes machines and applications that build Axios into their JavaScript code for HTTP requests, regardless of the runtime environment (Node.js or browsers).

The CVSS score of 7.5 indicates a high severity but the EPSS score of 3% indicates a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious configuration object—typically via JSON.parse()—to an Axios instance that processes untrusted input. Based on inference, the attack vector is application-level data injection; the attacker must influence configuration data that is fed into the mergeConfig routine.