Repository navigation

Issues

New issue

axios@1.14.1 and axios@0.30.4 are compromised
#10604 · ashishkurmi opened on Mar 31, 2026
317
Post Mortem: axios npm supply chain compromise
#10636 · jasonsaayman opened on Apr 2, 2026
110

http adapter: req.setTimeout(0) via follow-redirects leaves a socket destroy listener that breaks other clients sharing http.globalAgent (socket hang up)
axios/axios#11440 · opened on Nov 10, 2026
1
Fetch upload tracking drops string chunks from a ReadableStream
axios/axios#11379 · opened on Oct 25, 2026
Progress throttle crashes with "args is not iterable" when the trailing timer fires after flush (setTimeout wrapped by third-party code)
axios/axios#11338 · opened on Oct 19, 2026
1
Node HTTP adapter fails to decode deflate responses made with a zlib window smaller than 32K
axios/axios#11333 · opened on Oct 17, 2026
Node http adapter drops the filename of FormData files with an empty name, so they arrive as text fields
axios/axios#11331 · opened on Oct 17, 2026
1
http adapter: keep-alive sockets retain their last request and response when following redirects (kAxiosCurrentReq never cleared)
axios/axios#11325 · opened on Oct 14, 2026
Node HTTP adapter rejects non-base64 data URLs with non-UTF-8 escapes or a stray %
axios/axios#11318 · opened on Oct 14, 2026
XHR adapter can read responseText when the native responseType has changed
axios/axios#11314 · opened on Oct 13, 2026
formToJSON throws for nested fields named length
axios/axios#11295 · opened on Oct 6, 2026
2
Fetch adapter leaves response open after Content-Length limit rejection
axios/axios#11292 · opened on Oct 5, 2026
Inconsistent handling of primitive request bodies across adapters (silent drop vs ERR_BAD_REQUEST)
axios/axios#11291 · opened on Oct 4, 2026
1
Nested Buffer fields lose their parent paths in URL-encoded requests
axios/axios#11289 · opened on Oct 4, 2026
1
Axios 1.20.0 fetch adapter still sends inherited headers with ordinary fetchOptions on Node
axios/axios#11263 · opened on Sep 30, 2026
1
Primitive request bodies: the three adapters disagree, and two of them silently drop the body
axios/axios#11258 · opened on Sep 29, 2026
2
AxiosHeaders set() never calls a rewrite function, so the header is never overwritten
axios/axios#11247 · opened on Sep 23, 2026
fetch adapter: response-stream capability probe leaks an uncancelled ReadableStream
axios/axios#11240 · opened on Sep 21, 2026
AxiosError.prototype.toJSON() can OOM when config includes an httpAgent/httpsAgent
axios/axios#11145 · opened on Aug 12, 2026
4
Old version of https-proxy-agent used
axios/axios#11030 · opened on Jun 23, 2026
5
Benchmark idea: FormData-to-JSON conversion with nested keys
axios/axios#10982 · opened on Jun 1, 2026
Undici adapter: pick up and finish PR #6915
axios/axios#10885 · opened on May 13, 2026
1
feature-request: support application/x-ndjson (automatically native shift from the typical "wait-for-the-whole-object" mindset to a streaming approach)
axios/axios#10751 · opened on Apr 18, 2026
1
proposal: improving typings of AxiosRequestTransformer
axios/axios#10744 · opened on Apr 17, 2026
3
Lack of structured error categorization for "Network Error" reduces debugging clarity
axios/axios#10735 · opened on Apr 16, 2026
1
feat(core): add native Retry-After header support for 429 / 503 responses
axios/axios#10732 · opened on Apr 16, 2026
1
feature request: transformRequest must be able to be asynchronous
axios/axios#10713 · opened on Apr 14, 2026
11

Navigation Menu

Repository navigation

Issues

Issues

http adapter: req.setTimeout(0) via follow-redirects leaves a socket destroy listener that breaks other clients sharing http.globalAgent (socket hang up)

Fetch upload tracking drops string chunks from a ReadableStream

Progress throttle crashes with "args is not iterable" when the trailing timer fires after flush (setTimeout wrapped by third-party code)

Node HTTP adapter fails to decode deflate responses made with a zlib window smaller than 32K

Node http adapter drops the filename of FormData files with an empty name, so they arrive as text fields

http adapter: keep-alive sockets retain their last request and response when following redirects (`kAxiosCurrentReq` never cleared)

Node HTTP adapter rejects non-base64 data URLs with non-UTF-8 escapes or a stray %

XHR adapter can read responseText when the native responseType has changed

formToJSON throws for nested fields named length

Fetch adapter leaves response open after Content-Length limit rejection

Inconsistent handling of primitive request bodies across adapters (silent drop vs ERR_BAD_REQUEST)

Nested Buffer fields lose their parent paths in URL-encoded requests

Axios 1.20.0 fetch adapter still sends inherited headers with ordinary fetchOptions on Node

Primitive request bodies: the three adapters disagree, and two of them silently drop the body

AxiosHeaders set() never calls a rewrite function, so the header is never overwritten

fetch adapter: response-stream capability probe leaks an uncancelled ReadableStream

`AxiosError.prototype.toJSON()` can OOM when config includes an `httpAgent`/`httpsAgent`

Old version of https-proxy-agent used

Benchmark idea: FormData-to-JSON conversion with nested keys

Undici adapter: pick up and finish PR #6915

feature-request: support application/x-ndjson (automatically native shift from the typical "wait-for-the-whole-object" mindset to a streaming approach)

proposal: improving typings of `AxiosRequestTransformer`

Lack of structured error categorization for "Network Error" reduces debugging clarity

feat(core): add native Retry-After header support for 429 / 503 responses

feature request: `transformRequest` must be able to be asynchronous