Promise based HTTP client for the browser and node.js
13 May 2026 · Newest first
Last checked
Checking sources…
Showing 1 of 1 releases. Full release notes.
Signals highlight changes worth reviewing. They cannot determine whether your application is affected.
CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)
Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.
formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)@commitlint/cli from 20.5.0 to 20.5.2. (#10846)We are thrilled to welcome our new contributors. Thank you for helping improve axios: