REDHAT-BUG-2438237: High severity npm/axios vulnerability
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in 1.13.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2438237?
The severity of REDHAT-BUG-2438237 is rated as high with a score of 7.
What impact does REDHAT-BUG-2438237 have on applications using Axios?
REDHAT-BUG-2438237 can lead to application crashes due to a TypeError when an attacker provides a malicious configuration object.
How do I fix REDHAT-BUG-2438237?
To fix REDHAT-BUG-2438237, upgrade Axios to version 1.13.5 or later, which resolves the issue.
What versions of Axios are affected by REDHAT-BUG-2438237?
Versions of Axios prior to 1.13.5 are affected by REDHAT-BUG-2438237.
Can REDHAT-BUG-2438237 be exploited remotely?
Yes, an attacker can exploit REDHAT-BUG-2438237 remotely by providing a specially crafted configuration object.