fix: harden runtime option handling by jasonsaayman · Pull Request #11141 · axios/axios

jasonsaayman · 2026-08-11T09:14:39Z

Summary

Harden runtime option handling against shared-prototype pollution and make Fetch, HTTP/2, proxy bypass, and data URI behavior consistent across supported runtimes.

Linked issue

N/A

Changes

Filter request behavior inherited only from shared prototypes, including a foreign realm's Object.prototype when its mutable constructor property has been changed, deleted, or replaced by an accessor.
Preserve an already-safe merged request config by identity through request interceptors, adapters, and response.config.
Normalize interceptor replacement objects with non-terminal application prototypes into null-prototype snapshots while preserving safe inherited fields. Terminal null-prototype ancestors are excluded as a fail-closed boundary.
Pass fully resolved Request objects to custom Fetch implementations and honor maxRedirects: 0 with manual redirects.
Support custom DNS lookup for HTTP/2, reject explicit proxied HTTP/2 requests, and remove failed pooled sessions safely.
Add IPv4 and IPv6 CIDR matching for NO_PROXY and harden malformed data URI parsing.

Intentional compatibility changes

Interceptor replacements that require sanitization are normalized snapshots. Their original identity, prototype, instanceof branding, accessor placement, and descriptor attributes are not retained.
Custom Fetch implementations receive the authoritative method, headers, body, signal, duplex, and credentials on the resolved Request. Those fields are omitted from the second safe fetchOptions argument; custom implementations that inspected the second argument must migrate to the Request.
Fetch maxRedirects: 0 now prevents redirect following. Node may expose the unfollowed 3xx response, while browsers may expose an opaque redirect with status 0 and inaccessible headers.
Explicit Axios proxy objects with HTTP/2 now reject with ERR_NOT_SUPPORT instead of being silently ineffective.
Media types containing extra slash separators in data URIs now reject with ERR_INVALID_URL.
Fields inherited from a terminal Object.create(null) config template are excluded because such a template cannot be distinguished safely from a mutated foreign Object.prototype.
NO_PROXY=0.0.0.0/0 bypasses proxying for all IPv4 destinations, and NO_PROXY=::/0 does the same for IPv6.

HTTP/2 proxy policy residual

HTTP/2 remains direct when proxy policy exists only in process environment variables or an HTTP/1 agent's proxyEnv, because http2.connect() cannot apply those proxy mechanisms. Deployments that require proxying as an egress boundary should not treat this change as full HTTP/2 proxy-policy enforcement.

Validation

Focused utility, prototype-pollution, and Fetch adapter suites: 164 tests passed.
Full unit suite: 57 files, 1,035 tests passed.
Browser-headless suite: 57 files, 591 tests passed.
Source lint passed.
git diff --check passed.

Checklist

Tests added or updated.
Deferred release documentation notes updated; no public declaration changes.
Observable compatibility changes are called out explicitly above.

Semantic version impact

Security/runtime hardening with intentional compatibility changes documented above; this PR does not claim complete backward compatibility.

greptile-apps · 2026-08-11T09:23:08Z

Greptile Summary

This update strengthens runtime option handling across Axios adapters. Direct HTTP/2 requests with proxy: false were verified to complete successfully even when the selected agent supports environment-proxy configuration; the former ERR_NOT_SUPPORT failure was disproved on the current code. Fetch requests were also verified to retain Axios-controlled request fields while safely forwarding unrelated Fetch options and preserving manual redirects.

Confidence Score: 5/5

Safe to merge based on the exercised HTTP/2 proxy-disable and Fetch option-resolution behaviors.

No blocking failure remains.

T-Rex Logs

What T-Rex did

Validated the focused local HTTP/2 proxyEnv-agent runtime reproduction and confirmed that with proxying disabled the current code returns 200 OK instead of ERR_NOT_SUPPORT.
Ran the Fetch adapter validation suite; 69 tests in tests/unit/adapters/fetch.test.js passed, confirming Axios-controlled request fields remain authoritative while unrelated Fetch options and manual redirects work as expected.
Verified the HTTP/2 proxy-env behavior path in lib/adapters/http.js; the code now allows direct HTTP/2 requests when proxies are disabled, fixing the previous ERR_NOT_SUPPORT regression.
Compared Axios-owned values to custom Fetch initialization; after the change the custom Fetch call receives only safe options while Axios’s request data remains intact, and no finding was reported regarding isolation and redirects.

_{Ran code and verified through T-Rex}

_{Reviews (7): Last reviewed commit: "test: clarify unsafe prototype fixtures" | Re-trigger Greptile}

cubic-dev-ai

All reported issues were addressed across 20 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 8 files (changes from recent commits).

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 6 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

Raises axios from ^1.18.0 (resolving to 1.19.0) to ^1.20.0, addressing the runtime-option prototype-pollution hardening in axios PR #11141 (axios/axios#11141). Verified via GitHub's official Releases API and the PR's "Intentional compatibility changes" list that none of the documented behavior changes (interceptor replacement objects, custom Fetch adapter second argument, maxRedirects: 0, explicit proxy objects over HTTP/2, data-URI parsing) apply to this repo's usage, which is limited to plain axios.get/axios.post calls with the default browser XHR adapter in the auth service files.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [axios](https://axios-http.com) ([source](https://github.com/axios/axios)) | [`1.18.1` → `1.20.0`](https://renovatebot.com/diffs/npm/axios/1.18.1/1.20.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/axios/1.20.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/axios/1.18.1/1.20.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information. --- ### Release Notes <details> <summary>axios/axios (axios)</summary> ### [`v1.20.0`](https://github.com/axios/axios/releases/tag/v1.20.0) [Compare Source](axios/axios@v1.19.0...v1.20.0) #### v1.20.0 — August 19, 2026 This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation. #### ⚠️ Breaking Changes & Deprecations - HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. ([#11082](axios/axios#11082)) #### 🔒 Security Fixes - Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. ([#11141](axios/axios#11141)) #### 🐛 Bug Fixes - Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. ([#11087](axios/axios#11087), [#11118](axios/axios#11118)) - Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. ([#11109](axios/axios#11109)) - XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. ([#11094](axios/axios#11094), [#11121](axios/axios#11121)) - Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. ([#11091](axios/axios#11091)) - Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. ([#11096](axios/axios#11096)) #### 🔧 Maintenance & Chores - Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. ([#11092](axios/axios#11092), [#11098](axios/axios#11098), [#11099](axios/axios#11099), [#11106](axios/axios#11106), [#11107](axios/axios#11107), [#11122](axios/axios#11122), [#11123](axios/axios#11123), [#11126](axios/axios#11126), [#11127](axios/axios#11127), [#11133](axios/axios#11133), [#11140](axios/axios#11140), [#11143](axios/axios#11143), [#11144](axios/axios#11144)) - Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. ([#11101](axios/axios#11101), [#11113](axios/axios#11113), [#11097](axios/axios#11097), [#11119](axios/axios#11119)) - Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. ([#11124](axios/axios#11124), [#11136](axios/axios#11136), [#11137](axios/axios#11137)) - CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. ([#11128](axios/axios#11128), [#11152](axios/axios#11152)) #### 🌟 New Contributors We are thrilled to welcome our new contributors. Thank you for helping improve axios: - [@yens1](https://github.com/yens1) ([#11109](axios/axios#11109)) - [@Sasireddy001](https://github.com/Sasireddy001) ([#11113](axios/axios#11113)) - [@ari-token-security](https://github.com/ari-token-security) ([#11094](axios/axios#11094)) - [@timothyokooboh](https://github.com/timothyokooboh) ([#11097](axios/axios#11097)) - [@gi9439041-png](https://github.com/gi9439041-png) ([#11119](axios/axios#11119)) - [@Hashim1999164](https://github.com/Hashim1999164) ([#11082](axios/axios#11082)) - [@v-dev-cl](https://github.com/v-dev-cl) ([#11091](axios/axios#11091)) - [@r0h1tb](https://github.com/r0h1tb) ([#11118](axios/axios#11118)) - [@ostapondo](https://github.com/ostapondo) ([#11121](axios/axios#11121)) Full Changelog (<axios/axios@v1.19.0...v1.20.0>) ### [`v1.19.0`](https://github.com/axios/axios/blob/HEAD/CHANGELOG.md#v1190--July-22-2026) [Compare Source](axios/axios@v1.18.1...v1.19.0) This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1808

fix: harden runtime option handling

745160b

jasonsaayman self-assigned this Aug 11, 2026

jasonsaayman added the commit::fix The PR is related to a bugfix label Aug 11, 2026

greptile-apps Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread lib/adapters/http.js Outdated

cubic-dev-ai Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread lib/utils.js Outdated

Comment thread lib/adapters/http.js

Comment thread lib/adapters/fetch.js Outdated

Comment thread lib/adapters/fetch.js

fix: address runtime consistency review

4bee948

cubic-dev-ai Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread lib/utils.js Outdated

jasonsaayman added 3 commits August 11, 2026 13:44

fix: bound safe prototype traversal

b2b3941

Merge branch 'v1.x' into maintenance/runtime-consistency

1f96509

fix: close runtime consistency review gaps

57ba16d

cubic-dev-ai Bot reviewed Aug 11, 2026

View reviewed changes

Comment thread lib/utils.js

Comment thread lib/utils.js

Comment thread tests/unit/utils/isX.test.js Outdated

jasonsaayman added 2 commits August 11, 2026 18:34

fix: preserve config materialization invariants

8737503

docs: remove AI contribution marker requirement

447ac6c

github-code-quality Bot found potential problems Aug 11, 2026

View reviewed changes

Comment thread tests/unit/utils/isX.test.js Fixed

Comment thread tests/unit/prototypePollution.test.js Fixed

test: clarify unsafe prototype fixtures

e6352a6

github-code-quality Bot found potential problems Aug 11, 2026

View reviewed changes

Comment thread tests/unit/utils/isX.test.js Dismissed

Comment thread tests/unit/prototypePollution.test.js Dismissed

jasonsaayman merged commit d19040b into v1.x Aug 12, 2026
32 checks passed

jasonsaayman deleted the maintenance/runtime-consistency branch August 12, 2026 16:27

Jaybhade mentioned this pull request Aug 24, 2026

fix(helpers): detect data: URL base64 as a trailing media type token #11130

Closed

3 tasks done

This was referenced Aug 25, 2026

httpsAgent TLS options (ca) still dropped when used with proxy in 1.18.0 #11168

Closed

AxiosError.prototype.toJSON() can OOM when config includes an httpAgent/httpsAgent #11145

Open

tristanbes mentioned this pull request Sep 2, 2026

1.20.0 fetch adapter sets cache: 'default' on every Request → TypeError: Unsupported cache mode on Cloudflare Workers #11192

Closed

adrianbrowning mentioned this pull request Sep 4, 2026

Upstream sync: port applicable fixes from axios v1.18.0, v1.18.1, and unreleased main adrianbrowning/faxios#27

Closed

21 tasks done

This was referenced Sep 11, 2026

DCON-5481 Bump axios to 1.20.0 to fix AIKIDO-2026-872099 icanbwell/fhir-server#2583

Merged

DCON-5487 build(deps): bump axios to ^1.20.0 icanbwell/fhir-server-ui#284

Merged

karanh37 mentioned this pull request Sep 30, 2026

fix(security): bump axios to 1.20.0 open-metadata/OpenMetadata#34257

Closed

ognjhunt mentioned this pull request Sep 30, 2026

Show blocked canary evidence and patch Axios security advisories ognjhunt/Blueprint-WebApp#771

Merged

markscott-ms mentioned this pull request Oct 1, 2026

build(deps): bump axios to 1.20.0 including root override finos/architecture-as-code#3187

Merged

9 of 12 tasks

This was referenced Oct 1, 2026

fix(deps): upgrade axios to 1.20.0 for security fixes Altinn/altinn-studio#20908

Merged

fix(deps): patch axios security alerts and deduplicate dependencies Altinn/app-frontend-react#4357

Merged

aolea mentioned this pull request Oct 5, 2026

fix(ci): restore fork qualification and cold doctor loading aolea/openclaw#3

Merged

renovate Bot mentioned this pull request Oct 6, 2026

Security patches (stable/1.x) DefGuard/defguard-renovate#449

Open

sony-mathew mentioned this pull request Oct 7, 2026

chore(deps): bump axios from 1.15.0 to 1.20.0 chatwoot/chatwoot#16180

Merged

olexii4 mentioned this pull request Oct 8, 2026

fix(deps): upgrade fastify to 5.12.5 and axios to 1.20.0 eclipse-che/che-dashboard#1688

Merged

renovate-sh-app Bot mentioned this pull request Oct 9, 2026

fix(deps): update all non-major dependencies grafana/openapi-to-k6#170

Merged

Navigation Menu

Repository navigation

fix: harden runtime option handling - #11141

fix: harden runtime option handling#11141
jasonsaayman merged 8 commits into
v1.xfrom
maintenance/runtime-consistency

jasonsaayman commented Aug 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 11, 2026 •

edited

Loading

T-Rex Logs

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jasonsaayman commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked issue

Changes

Intentional compatibility changes

HTTP/2 proxy policy residual

Validation

Checklist

Semantic version impact

Uh oh!

greptile-apps Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

T-Rex Logs

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jasonsaayman commented Aug 11, 2026 •

edited

Loading

greptile-apps Bot commented Aug 11, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading