Taking Down the Internet's Most Popular HTTP Client with a Single JSON Key (opens in new tab)

(striga.ai)

10 pointstraekfuglene1mo ago1 comments

1 comments

We used Striga to discover a high-severity vulnerability in axios, the most downloaded HTTP client in JavaScript. Any Node.js service that forwards user-controlled JSON through axios can be crashed with a single request. CVE-2026-25639. Patched in 1.13.5.

j / k navigate · click thread line to collapse

1 comments

traekfugleneOP1mo ago

j / k navigate · click thread line to collapse