VDB

GHSA-43fc-jf86-j433

GHSA-43fc-jf86-j433 PUBLISHED CVSS 7.5 HIGH

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Record from GitHub Advisory Database · Published February 9, 2026

axios is fixed in 1.13.5 and 0.30.3 (npm)

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
axiosnpm1.13.5, 0.30.3
gitlab-rails-ce-fips-18.10Chainguard18.10.8-r8
opensearch-dashboards-2-fipsChainguard2.19.4-r9
kubeflow-katibWolfi0.19.0-r40, 0.19.0-r31
kubeflow-katibChainguard0.19.0-r31
gitlab-rails-ce-fips-19.3Chainguard19.3.1-r3
safChainguard1.6.0-r0
gitlab-rails-ce-19.2Chainguard19.2.5-r2, 19.2.4-r4
lernaWolfi9.0.4-r2
opensearch-dashboards-2Chainguard2.19.4-r9
opensearch-dashboards-2Wolfi2.19.4-r9
nextcloud-server-31Chainguard31.0.14-r5

39 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
chainguardgitlab-rails-ce-fips-18.100
chainguardopensearch-dashboards-2-fips0
wolfikubeflow-katib0, 0
chainguardkubeflow-katib0
chainguardgitlab-rails-ce-fips-19.30
chainguardsaf0
chainguardgitlab-rails-ce-19.20, 0
wolfilerna0
chainguardopensearch-dashboards-20
wolfiopensearch-dashboards-20
chainguardnextcloud-server-310
wolfikubeflow-centraldashboard0
chainguardjitsucom-jitsu0
chainguardnextcloud-server-330
chainguardarangodb-3.110
chainguardkibana-9.20
chainguardgitlab-rails-ce-19.30, 0
chainguardgitlab-rails-ce-fips-18.110, 0
chainguardgitlab-rails-ce-18.100
chainguardlangfuse-30

…and 32 more

Timeline

  • Feb 9, 2026 CVE Published
  • Mar 2, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-43fc-jf86-j433
vulnetix vdb fixes GHSA-43fc-jf86-j433

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-43fc-jf86-j433/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›