A critical denial of service vulnerability in the Axios library allows unauthenticated attackers to crash applications by supplying malicious configuration objects.

The vulnerability resides in the mergeConfig function, which fails to properly validate input when processing configuration objects. An unauthenticated attacker can trigger a TypeError by injecting a proto property, resulting in a complete application crash.

Successful exploitation leads to a complete denial of service for any application relying on the affected versions of Axios. Given the widespread use of this library in both browser and Node.js environments, this could result in significant operational downtime for critical web services. With a CVSS score of 7.5, the vulnerability is classified as High severity due to the ease of exploitation and the potential for total service interruption.

Immediate Action: Update the Axios package to version 1.13.5 or 0.30.3 immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Monitor application logs for unexpected TypeError exceptions or service restarts occurring during HTTP request processing.

Compensating Controls: Implement strict input validation on any user-supplied JSON data before passing it to Axios configuration objects to prevent the injection of malicious properties.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the fundamental nature of the Axios library in modern web development. Security teams must prioritize updating the dependency to the patched versions to prevent potential service instability. Given the simplicity of the attack vector, failure to patch leaves applications exposed to trivial denial of service attacks that could be automated by malicious actors.