Skip to content

Upgrading axios 0.31 to 0.32

Breaking0.31.1 → 0.32.0Breaking1Security11New1Other1

Full comparisonBack to axios
BreakingUpgrade verdict

1 breaking change and 5 security fixes.

In plain terms
  • Merged configuration and header objects no longer inherit from Object.prototype, so code that relied on inherited methods or implicit string coercion may behave differently.
  • axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
  • Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
  • axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Must act Top 4 of 6 that need code or config changes

What you must change

Breaking1
mergeConfig and header merging now return null-prototype objects to block prototype-pollution gadgets.
mergeConfigObject.prototype.hasOwnProperty.call
0.32.0GitHub ReleaseSummarizedView source
Security5
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
NO_PROXYAxiosURLSearchParamsProxy-AuthorizationsocketPathallowedSocketPathswithXSRFTokenAxiosError.toJSON()config.redactdefaults.redactHigh · CVSS 8.6
0.32.0GitHub AdvisoryOriginalView source
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
High
0.32.0GitHub AdvisoryOriginalView source
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Moderate · CVSS 4.8
0.32.0GitHub AdvisoryOriginalView source
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
High · CVSS 7.5
0.32.0GitHub AdvisoryOriginalView source
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
High · CVSS 7.5
0.32.0GitHub AdvisoryOriginalView source

API changes

Generated by DepDelta from published .d.ts files. Not mixed with prose notes.

  • added: property AxiosRequestConfig.allowedSocketPaths?: string | string[] | null
  • added: property AxiosRequestConfig.formDataHeaderPolicy?: 'legacy' | 'content-only'
  • added: property AxiosRequestConfig.redact?: string[]