Skip to content

Upgrading axios 0.30 to 0.31

Breaking0.30.3 → 0.31.1Breaking1Security18Fixed2Other2

Full comparisonBack to axios
BreakingUpgrade verdict

1 breaking change and 18 security fixes.

In plain terms
  • The prebuilt files and Bower packaging are gone from the repository. If you installed axios with Bower or straight from git, switch to npm or a CDN.
  • Blocks a way to inject extra HTTP headers by tampering with JavaScript object prototypes.
  • Prevents attackers from hijacking request settings by polluting shared JavaScript object prototypes.
  • Limits how deeply nested data can be converted, so malicious deeply nested input cannot exhaust the server.
Must act Top 4 of 19 that need code or config changes

What you must change

Breaking1
Removes committed dist/ bundles, bower.json and the Grunt package2bower task; Bower and git-tree installs must migrate to npm or a CDN.
dist/bower.jsonpackage2bower
0.31.1GitHub ReleaseSummarizedView source
Security18
Tightens isFormData to reject plain/null-prototype objects and require append, and only merges data.getHeaders() when not inherited from Object.prototype.
isFormDatadata.getHeaders()Object.prototypeHigh · CVSS 7.4
0.31.1GitHub ReleaseSummarizedView source
Uses own-property checks in mergeConfig, defaults resolution and the HTTP adapter, and returns merged configs as null-prototype objects.
mergeConfigtransportenvBlobformSerializerHigh · CVSS 7.4
0.31.1GitHub ReleaseSummarizedView source
Adds a configurable maxDepth (default 100, Infinity disables) to toFormData and params serialisation, throwing ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded.
maxDepthtoFormDataAxiosErrorERR_FORM_DATA_DEPTH_EXCEEDED
0.31.1GitHub ReleaseSummarizedView source
Removes the unsafe %00 to null-byte substitution in AxiosURLSearchParams.encode so %00 is preserved as-is.
AxiosURLSearchParams.encode
0.31.1GitHub ReleaseSummarizedView source
Backports v1 hardenings: maxContentLength for stream responses, maxBodyLength for streamed uploads with maxRedirects 0, and stricter withXSRFToken handling.
maxContentLengthresponseTypemaxBodyLengthmaxRedirectswithXSRFToken
0.31.1GitHub ReleaseSummarizedView source
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
High · CVSS 7.0
0.31.1GitHub AdvisoryOriginalView source
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Low · CVSS 3.7
0.31.1GitHub AdvisoryOriginalView source
Axios: HTTP adapter streamed responses bypass maxContentLength
Moderate · CVSS 5.3
0.31.1GitHub AdvisoryOriginalView source
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion
Moderate · CVSS 5.4
0.31.1GitHub AdvisoryOriginalView source
Axios: no_proxy bypass via IP alias allows SSRF
Moderate · CVSS 6.8
0.31.1GitHub AdvisoryOriginalView source
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
High · CVSS 7.2
0.31.1GitHub AdvisoryOriginalView source
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Moderate · CVSS 5.3
0.31.1GitHub AdvisoryOriginalView source
Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy
Moderate · CVSS 4.8
0.31.1GitHub AdvisoryOriginalView source
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Moderate · CVSS 7.5
0.31.1GitHub AdvisoryOriginalView source
Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds…
NO_PROXYno_proxylocalhostparsed.host
0.31.0GitHub ReleaseOriginalView source
CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces zizmor security scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow…
zizmornpm-publish
0.31.0GitHub ReleaseOriginalView source
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Moderate · CVSS 4.8
0.31.0GitHub AdvisoryOriginalView source
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Moderate · CVSS 4.8
0.31.0GitHub AdvisoryOriginalView source

API changes

Generated by DepDelta from published .d.ts files. Not mixed with prose notes.

  • changed: call AxiosInstance<T = any, R = AxiosResponse<T>, D = any>(config: AxiosRequestConfig<D>): AxiosPromise<R> → call AxiosInstance<T = any, R = AxiosResponse<T>, D = any>(config: AxiosRequestConfig<D>): Promise<R>
  • changed: call AxiosInstance<T = any, R = AxiosResponse<T>, D = any>(url: string, config?: AxiosRequestConfig<D>): AxiosPromise<R> → call AxiosInstance<T = any, R = AxiosResponse<T>, D = any>(url: string, config?: AxiosRequestConfig<D>): Promise<R>
  • added: static readonly property AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED'