Axios release notes, breaking changes, and upgrade notes.
Promise based HTTP client for the browser and Node.js StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release focuses on security improvements, configuration extensibility, and bug fixes. Key updates include raising the form-data dependency floor to address a CRLF injection vulnerability, enhancing TypeScript support, and improving NO_PROXY matching.
affected
Users relying on form-data or needing enhanced TypeScript support are most affected.
action
Update to v1.19.0 to benefit from security fixes and new features.
release_signals
!Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx.
+Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations.
+Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing.
+HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations.
This release focuses on security improvements, including redirect header safety and URL hardening, along with bug fixes and maintenance updates.
affected
Users relying on custom auth headers or handling malformed URLs may be affected by the security and URL hardening changes.
action
Review and update any code that uses custom headers or handles URLs to ensure compatibility with the new security measures.
release_signals
!Redirect Header Safety: Strips caller-specified sensitive headers on cross-origin redirects to prevent leaks
!URL And Request Hardening: Rejects malformed URLs and tightens config reads, stream size limits, and FormData depth handling
+
v0.33.0highfeaturesecurityJun 13, 2026
v0.33.0
This release focuses on security hardening for request config handling and form serialization, adds Node.js 26 support, and updates the release workflow.
affected
Users relying on nested request config options or form serialization may be affected by the security hardening changes.
action
Review and test request config handling and form serialization in your application.
release_signals
!Hardens request config handling with own-property reads for nested options.
!Adds bounded form serialization depth checks.
!Normalizes nullish Basic Auth credentials.
!Treats `0.0.0.0` as local for proxy bypass.
v1.17.0highfeaturesecurityJun 3, 2026
v1.17.0
This release introduces Node HTTP zstd decompression, hardens security configurations, and fixes various regressions related to authentication, headers, proxies, and type handling.
affected
Users relying on inherited prototype values for `socketPath`, `params`, or `paramsSerializer` may need to adjust their configurations.
action
Review configurations for `socketPath`, `params`, and `paramsSerializer` to ensure they are not relying on inherited prototype values.
release_signals
!Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths.
!Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance.
v1.16.1highbreakingsecurityMay 13, 2026
v1.16.1
This release includes a defence-in-depth fix for prototype pollution in `formDataToJSON`, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.
affected
Users relying on passing `URL` objects as `config.url` will need to revert to string URLs until the feature is reintroduced.
action
Update to v1.16.1 to benefit from security fixes and bug improvements, and revert to string URLs if using `URL` objects as `config.url`.
release_signals
-Reverted support for passing a `URL` object as `config.url` due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed.
!Hardened `formDataToJSON` against already-polluted `Object.prototype` by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization.
This release backports security and hardening fixes from the v1.x branch into v0.x, including prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and a breaking change to merged config and header object prototypes.
affected
Users relying on implicit string coercion against merged config or header objects will be affected.
action
Update code to use Object.prototype.hasOwnProperty.call(obj, key) for merged config or header objects.
release_signals
-mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects.
This release introduces support for the QUERY HTTP method and a new `ECONNREFUSED` error constant, along with significant bug fixes for HTTP, fetch, and XHR adapters related to redirects, aborts, headers, and timeouts.
affected
Users relying on `maxBodyLength` and `maxContentLength` in the fetch adapter, or those using percent-encoded credentials in URLs, will be affected.
action
Review the changes related to `maxBodyLength`, `maxContentLength`, and URL-decoded credentials before upgrading.
release_signals
-Fetch adapter now enforces `maxBodyLength` and `maxContentLength`, which were previously ignored.
-
v1.15.2highfeaturesecurityApr 21, 2026
v1.15.2
This release focuses on security hardening, including prototype pollution mitigation, SSRF prevention via Unix domain sockets, and supply-chain improvements. It also fixes a keep-alive socket memory leak and introduces a new `allowedSocketPaths` config option.
affected
Users relying on Unix domain sockets or handling sensitive configurations in Node.js environments are most affected.
action
Review and update configurations to use the `allowedSocketPaths` option if Unix domain sockets are utilized.
release_signals
!Prototype Pollution Hardening: Hardened Node HTTP adapter and config paths to prevent polluted properties from influencing requests.
!SSRF via `socketPath`: Rejects non-string `socketPath` values and adds `allowedSocketPaths` to restrict Unix domain socket paths.
Added Node HTTP adapter support for stripping sensitive headers on cross-origin redirects
+Rejects malformed `http:` and `https:` URLs that omit `//` with `ERR_INVALID_URL`
+Added `transitional.validateStatusUndefinedResolves` for handling `validateStatus: undefined`
Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`.