npm / axios
axios
What changed in axios 0.31 to 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
29 breaking61 security17 new APIs and options2 performance10 behavior and defaults3 tooling82 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initaxios 1180 changes
Breaking changes 23
Invalid DNS lookup and httpVersion failures are now standardized as AxiosError.ERR_BAD_OPTION_VALUE.
XHR requests canceled by navigation now reject with ECONNABORTED instead of resolving with status 0.
Inherited properties no longer influence serializer options, default methods, interceptor-returned headers, or redirect hooks; required values must be own properties.
getSetCookie() now consistently returns arrays for present values.
The dependency floor is now ^4.0.6 to prevent fresh installations from resolving versions affected by a CRLF injection vulnerability.
Path splitting now recognizes only dot and bracket notation, preserving literal punctuation in keys.
Requests are not dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully.
The Node HTTP adapter strips caller-specified sensitive headers on cross-origin redirects to prevent credentials such as API keys from leaking.
Malformed http: and https: URLs without // are rejected with ERR_INVALID_URL.
Form serialisation now enforces bounded depth checks.
Passing a URL object as config.url is no longer supported because of regressions.
The fetch adapter now enforces maxBodyLength, providing protection against accidental large uploads and related denial-of-service risks.
Merged config and header objects now have null prototypes, requiring explicit own-property checks and avoiding implicit string coercion.
Protocol parsing now requires a colon in the protocol separator, so loosely matching strings may no longer be recognized.
The Node HTTP adapter strips Proxy-Authorization when no proxy is in use.
Rejects non-string socketPath values and disallowed paths with AxiosError ERR_BAD_OPTION_VALUE.
URL encoding no longer converts %00 into a null byte, preventing null-byte injection in query strings.
Exceeding FormData or params recursion depth now throws AxiosError with this code.
FormData detection now rejects plain or null-prototype objects and requires append.
maxBodyLength is now enforced for streamed uploads using native http or https with maxRedirects set to 0.
maxContentLength is now enforced for responseType stream responses.
Truthy non-boolean values now short-circuit XSRF token handling, preventing ambiguous configuration from leaking tokens cross-origin.
Only an own boolean true value now enables cross-origin XSRF headers.
Security 57
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Axios: Header Injection via Inherited headers After Minimal Interceptor
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios: Prototype Pollution Gadget in axios toFormData Options
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Hardened behavioral configuration reads against prototype pollution and normalized unsafe interceptor replacement objects.
Malformed-protocol errors now include normalized, safely redacted offending URLs.
0.0.0.0 is now treated as local for proxy bypass decisions.
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Axios: Fetch adapter
ReadableStreamuploads bypassmaxBodyLengthAxios form serializer maxDepth bypass via {} metatoken
Axios: HTTP/2 streamed uploads bypass
maxBodyLengthAxios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Axios: Prototype pollution auth subfields can inject Basic auth
Axios: Prototype pollution gadgets can alter axios request construction
FormData depth handling is tightened.
Local NO_PROXY matching is tightened.
Configuration reads are hardened against prototype pollution.
Nested request options now use own-property reads for auth, params, proxy, and data handling.
Stream size handling is tightened to improve request and response safety.
Reads are guarded with own-property checks so inherited prototype values cannot affect request behavior.
Reads are guarded with own-property checks so inherited prototype values cannot affect request behavior.
Reads are guarded with own-property checks so inherited prototype values cannot affect request behavior, including SSRF-sensitive paths.
Own-property traversal prevents attacker-controlled keys inherited from a poisoned prototype from propagating through deserialization.
HTTPS request data is no longer transmitted in cleartext to an HTTP proxy under affected configurations.
Allocation of Resources Without Limits or Throttling in Axios
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in
config.proxyThe fetch adapter now enforces maxContentLength, providing protection against oversized responses.
Proxy bypass matching now supports canonical IPv4-mapped IPv6 forms.
Cookie names are read literally, and XSRF-token evaluation respects only own properties.
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in
parseReviverConfiguration processing now ignores inherited polluted properties, preventing sensitive request settings from being altered.
Axios: Authentication Bypass via Prototype Pollution Gadget in
validateStatusMerge StrategyAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Axios: no_proxy bypass via IP alias allows SSRF
Multipart header values now strip CR/LF characters to prevent injection through field names and filenames.
An earlier incomplete CVE fix is completed to fully close the regression window.
The Node HTTP adapter no longer merges inherited getHeaders values, blocking injected headers from polluted prototypes.
Configuration checks no longer rely on unsafe in checks, preventing authentication bypass through prototype pollution.
Request header construction now validates and sanitises values more strictly to close the header-injection attack surface.
Request body limits are enforced even when maxRedirects is set to 0, closing an oversized-body bypass.
Streamed responses now enforce maxContentLength instead of bypassing the configured cap.
Config merging uses own-property checks and returns null-prototype objects, preventing polluted prototypes from hijacking requests.
Fixed a vulnerability that could exfiltrate cloud metadata through a header injection chain.
Fixed hostname normalisation bypass handling that could enable Server-Side Request Forgery.
Axios restricts merging the __proto__ key to prevent prototype pollution and Denial of Service during configuration merging.
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
New APIs and options 14
Added the RFC 9110 status-code alias ContentTooLarge for HTTP 413 responses.
Added opt-in quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior.
Public TypeScript declarations now support a generic params type across APIs, responses, errors, adapters, and serializers.
Applications can opt in to treating validateStatus: undefined like an omitted option, while null still accepts every status.
Controls whether zstd is advertised in the Accept-Encoding header.
The Node HTTP adapter now supports zstd response decompression.
Exposed ECONNREFUSED as a constant so callers can match connection-refused failures without comparing string literals.
Re-exported create from the package index.
Exported the internal encode helper from buildURL so userland parameter serializers can reuse axios encoding logic.
Added support for the QUERY HTTP method across adapters and type definitions.
Adds an opt-in allowlist for Unix domain socket paths used by the Node HTTP adapter.
Axios now supports React Native Blob objects, improving integrations that send or handle Blob data.
AxiosRequestConfig now accepts undefined as a value.
Adds HTTP2 support to Axios HTTP requests.
Performance 1
Removed browser-facing Buffer.from usage to avoid unnecessary polyfills.
Behavior and default changes 8
Set values are serialized as arrays in JSON-compatible snapshots.
Environment proxy handling is deferred to Node.
Data URL sizing is tightened.
Empty or whitespace-only header names are silently skipped instead of throwing.
Proxy requests now preserve user-supplied Host headers, enabling virtual-host-style routing through a proxy.
FormData handling now supports multi-select fields.
Response header key types are now case-insensitive.
HTTPS connections now use port 443 by default.
Tooling 2
CommonJS typings now narrow isCancel to CanceledError<T>.
TypeScript IntelliSense now provides suggestions for string literals in widened unions.
Fixes and other changes 75
Interceptor handler arrays no longer grow unbounded after ejections, and nullish public handlers remain safe to operate on.
Successful XHR downloads now flush their final progress callback during the live loadend dispatch.
Corrected how timeoutErrorMessage is merged into request configuration.
Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations.
Already-aborted input signals are propagated immediately when abort signals are composed.
Useful AxiosError messages are synthesized from otherwise-empty AggregateError instances.
Combining base URLs now removes repeated trailing slashes.
Empty first values are preserved for duplicate singleton headers.
Base64 data URL size estimation is corrected so maxContentLength is enforced consistently by HTTP and Fetch adapters.
Own-enumerable symbol-keyed fields are preserved through configuration merging.
Proxy bypass matching now canonicalizes IPv4 shorthand, octal, and hexadecimal forms.
Wildcard entries are now honored within comma- or space-separated proxy bypass lists.
Final Node.js download progress events are delivered before streamed responses close.
Malformed negative progress values are clamped to zero.
AxiosError#cause is now non-enumerable, preventing circular JSON serialization failures when errors include nested causes.
The encoder callback now receives the AxiosURLSearchParams instance as this.
maxBodyLength is explicitly passed through to follow-redirects.
Several runtime crashes, type definition mismatches, and incorrect error handling paths were fixed.
Socket keep-alive handling is guarded for proxy agent streams, avoiding failures with those streams.
Path-only URLs are accepted when socketPath is configured.
Corrected the return types of AxiosHeaders.toJSON().
Basic auth is restored on same-origin Node redirects, while credentials continue to be stripped cross-origin.
React Native FormData no longer receives a default Content-Type, allowing multipart boundaries to be generated correctly.
The fetch adapter now matches HTTP adapter behavior for URL-embedded Basic auth.
User TLS options are preserved when tunneling HTTPS requests through HTTP CONNECT proxies.
Cloning plain request data now preserves enumerable symbol keys through axios merge logic.
Stricter RFC 2397 matching fixes edge cases in data: URL handling.
The context.source type is now optional to align with the ES2023 specification.
Non-ASCII header content remains intact when requests pass through interceptors.
The fetch adapter no longer uses syntax Webpack 4 cannot parse, restoring compatibility for legacy bundler users.
Malformed ProgressEvent payloads no longer crash uploads when loaded or total are missing or invalid.
The fetch adapter now preserves the original abort reason instead of replacing it with a generic error.
The parsed response is now attached to AxiosError when JSON.parse fails inside dispatchRequest.
Aborted streams now preserve the partial response object on AxiosError when headers have already arrived.
Credentials embedded in URLs are now URL-decoded before being sent on the wire.
Global access is deferred so importing the fetch adapter no longer throws a TypeError in restricted environments.
settle no longer emits errors with undefined error codes.
The timeout option is now honored during the connect phase when redirects are disabled.
The fetch adapter now sets the User-Agent header to match the HTTP adapter.
URL encoding now uses modern UTF-8 encoding instead of deprecated unescape(), making non-ASCII URL handling spec-correct.
Parameter serialisation uses an improved regex to avoid edge-case mismatches.
The base and relative URL check now uses strict equality.
Fetch FormData requests now omit Content-Type when no boundary is present.
Form-data serialisation no longer recurses incorrectly.
Malformed header and configuration values are parsed out instead of causing exceptions.
Socket-only request errors no longer leak keep-alive listeners.
Computable upload and download progress events now clamp loaded to total.
CommonRequestHeadersList now includes Location for accurate typing of redirect-aware requests.
Fetch abort handling now cancels request.body instead of the source stream.
The runWhen type now matches InterceptorManager runtime behavior.
Added compatibility checks and documentation for running Axios in Deno and Bun environments.
Usage was replaced to address Node.js deprecation warnings in recent Node.js versions.
Environment-based proxy handling is fixed for proxy-from-env v2 usage.
Detached HTTP/2 sessions are closed on timeout to avoid lingering sessions.
The package main entry regression affecting CommonJS consumers is fixed.
Trailing CRLF is trimmed from normalised header values.
ReadableStream instances created during request-stream capability probing are cancelled to prevent async resource leaks.
AxiosError.message is now enumerable, making it visible during property enumeration.
AxiosError.from now copies status from the source error, improving error propagation.
FormData detection is now safe in the WeChat Mini Program environment.
Module exports now work correctly in React Native and Browserify environments.
Ensures AxiosError includes the status field on and after v1.13.3.
Adds input validation to isAbsoluteURL.
AxiosError.cause is typed as Error again instead of unknown.
AxiosError is converted into a native error.
The AxiosInterceptorManager interface now includes handlers.
Axios is compatible with frozen prototypes.
Errors are handled in the same interceptor where they occur.
The package main field now corresponds to CommonJS artifacts.
A Bun exports condition loads the Node.js build instead of the browser build.
Empty proxy authorization no longer produces an unclear error message.
The http2 module now uses a default export, enabling stubs to work.
Fixed socket hang up errors for keep-alive requests when using timeouts.
Fixed an interruption affecting data streams for responses with non-OK HTTP statuses.
Prevents a TypeError when config.env is undefined in the fetch implementation.
axios 0.347 changes
Breaking changes 1
TypeScript rejects Promise, function, and custom-toString object header values; resolve or explicitly convert them before assignment.
New APIs and options 1
Requests and instances can enable caller stack capture to append original caller frames to asynchronous error stacks.
Behavior and default changes 1
NO_PROXY and no_proxy now support IPv4 and IPv6 CIDR ranges, allowing matching IP destinations to bypass the proxy.
Fixes and other changes 4
CanceledError.reason now preserves AbortSignal.reason, including objects and falsy values, through config merging.
Axios can load alongside a read-only Error.prototype.toJSON while preserving supplied own property descriptors and setters.
HTTP(S) proxy schemes accept optional trailing colons, casing, and surrounding whitespace; invalid nonempty values fail before connecting.
Synchronous interceptor and dispatch failures pass through response interceptors, with recovery promises awaited before dispatch.
axios 0.331 changes
Fixes and other changes 1
Nullish Basic Auth credentials are now normalised.
axios 0.325 changes
Breaking changes 2
AxiosError.toJSON() redacts sensitive keys by default, with behavior configurable through config.redact and defaults.redact.
socketPath is gated by an allowedSocketPaths allowlist that accepts strings or arrays and is normalized.
New APIs and options 1
The public TypeScript declarations and runtime defaults now include formDataHeaderPolicy.
Behavior and default changes 1
The browser XHR adapter applies stricter own-property checks when reading configuration and headers.
Fixes and other changes 1
URL parameter serialization keeps %00 encoded and applies consistent encoding throughout.
axios 0.3111 changes
Breaking changes 3
Bower support was removed; installs via Bower must migrate to npm or a CDN.
Committed dist bundles were removed; consumers using the git tree must migrate to npm or a CDN.
The Grunt package2bower task was removed as part of dropping Bower support.
Security 4
Proxy bypass enforcement now handles wildcards, ports, loopback aliases, IPv6, and trailing-dot hostnames before parsing proxy URLs.
Publishes are gated behind a required npm-publish GitHub Environment with configurable reviewer protections.
Outgoing header values are sanitized to strip invalid bytes, CRLF sequences, and boundary whitespace, including array values.
Adds zizmor security scanning with SARIF upload to code scanning for the CI/CD supply chain.
New APIs and options 1
toFormData and params serialization now support configurable recursion depth, with default 100 and Infinity disabling the limit.
Performance 1
Fixes excessive computation when isEmptyObject() receives a large string.
Tooling 1
Adds an OIDC Trusted Publishing workflow with npm provenance attestations.
Fixes and other changes 1
AxiosInstance methods now resolve to Promise<R>, and the generic call signature correctly enforces the response data type.