# Risk map — axios/axios

> Canonical page: https://codevetter.com/unpack/axios/risk-map

# Risk map — axios/axios

Scanned commit 56a5f1acdc41965f464eb59bec6cc828113ba546 (2026-09-16). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

This is a library whose entire job is attacker-adjacent I/O, and the code reflects that: nearly every security control is a hand-rolled invariant with a comment explaining the CVE or issue behind it, which means the blast radius of an innocuous-looking refactor is large. The highest-risk surfaces are `lib/adapters/http.js` (proxy/redirect/socketPath/decompression, 1490 lines, one function), `lib/core/mergeConfig.js` + `utils.toSafeFlatObject` (the prototype-pollution boundary), and `lib/helpers/resolveConfig.js` (XSRF cross-origin decision). Fragile coupling exists between the package.json `browser` alias map and any new Node-only import; adding one to a browser-reachable module silently ships `http2`/`zlib` into browser bundles. Legacy surface (`CancelToken`, `axios.Cancel`, `legacyInterceptorReqResOrdering`, `tslint.json`, `webpack.config.js`) is retained for compatibility and is easy to break inadvertently.
- The prototype-pollution boundary is enforced in at least five independent places — `mergeConfig`'s null-proto result and key filter, `dispatchRequest`'s `toSafeFlatObject`, `own()`/`getSafeProp` reads in the http and fetch adapters, `resolveConfig`'s `own()`, and `AxiosHeaders` rejecting `__proto__`/`constructor`/`prototype` parameter names — so a regression in any one of them reopens the class. — [lib/core/mergeConfig.js#L33-L46](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/mergeConfig.js#L33-L46) [lib/core/dispatchRequest.js#L35-L43](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/dispatchRequest.js#L35-L43) [lib/adapters/http.js#L566-L576](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L566-L576) [lib/helpers/resolveConfig.js#L28-L30](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/resolveConfig.js#L28-L30) [lib/core/AxiosHeaders.js#L113-L124](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/AxiosHeaders.js#L113-L124)
- Even `Object.defineProperty` calls use `__proto__: null` descriptors (in `AxiosError`, `mergeConfig`, `adapters.js`, `AxiosHeaders` accessors, and the fetch/http `cause` assignments) specifically so a polluted `Object.prototype.get` cannot convert a data descriptor into an accessor on the way in — an easy detail to drop when copying this pattern. — [lib/core/AxiosError.js#L146-L157](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/AxiosError.js#L146-L157) [lib/adapters/adapters.js#L28-L35](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/adapters.js#L28-L35) [lib/core/mergeConfig.js#L38-L46](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/mergeConfig.js#L38-L46)
- Credential-leak-on-redirect is guarded by hand: HTTP Basic `auth` is restored after a redirect only when `new URL(redirectOptions.href).origin === parsed.origin`, with a malformed-URL catch that leaves auth stripped (fail-safe). Removing the origin comparison would leak credentials cross-origin. — [lib/adapters/http.js#L1058-L1072](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1058-L1072) [THREATMODEL.md](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/THREATMODEL.md)
- `Proxy-Authorization` is deleted from headers on every redirect hop (skipped only on the initial request) so a target change that drops or swaps the proxy doesn't carry proxy credentials forward. — [lib/adapters/http.js#L276-L294](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L276-L294)
- Proxy fields are read with `utils.hasOwnProp` unless the proxy is a real `URL` instance, explicitly to stop a prototype-polluted `proxy.host` from redirecting traffic to an attacker-controlled host. — [lib/adapters/http.js#L295-L330](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L295-L330)
- `socketPath` is an SSRF/local-IPC surface mitigated by `allowedSocketPaths`: when set, the requested path must `path.resolve()`-equal an allow-list entry or the request rejects with `ERR_BAD_OPTION_VALUE`. When `allowedSocketPaths` is unset (the default) any socket path is permitted. — [lib/adapters/http.js#L969-L1000](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L969-L1000) [index.d.ts#L432-L433](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.d.ts#L432-L433)
- `options.insecureHTTPParser` is always written as an explicit own boolean (`Boolean(own('insecureHTTPParser'))`) rather than left absent, precisely so a polluted `Object.prototype.insecureHTTPParser` cannot enable Node's lenient parser through its internal options copy — a request-smuggling vector. — [lib/adapters/http.js#L1128-L1133](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1128-L1133)
- `maxContentLength`/`maxBodyLength` enforcement is duplicated across five code paths (Node buffered, Node streamed via async generator, Node streamed upload Transform, fetch chunk counting, fetch non-ReadableStream fallback) — decompression bombs are only bounded where the check exists, and `-1` (the default) means unlimited everywhere. — [lib/adapters/http.js#L1231-L1280](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1231-L1280) [lib/adapters/http.js#L1440-L1480](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1440-L1480) [lib/adapters/fetch.js#L545-L601](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/fetch.js#L545-L601) [lib/defaults/index.js#L154-L155](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/index.js#L154-L155)
- Cookie reading avoids building a `RegExp` from the cookie name — it splits on `;` and compares the literal name — because interpolating an attacker-influenced name would allow ReDoS or wrong-cookie matching. — [lib/helpers/cookies.js#L30-L51](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/cookies.js#L30-L51)
- The XSRF cross-origin decision hinges on a strict `withXSRFToken === true` comparison; any loosening (e.g. truthiness) would let a polluted `Object.prototype.withXSRFToken = 1` or a string `"false"` leak the token to third-party origins. — [lib/helpers/resolveConfig.js#L89-L101](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/resolveConfig.js#L89-L101)
- Memory-retention hazards are handled with symbols and bookkeeping that are easy to break: a module-scoped `handleSocketError` plus `kAxiosSocketListener`/`kAxiosCurrentReq` symbols and a `boundSockets` Set exist because per-request socket listeners leaked adapter context across keep-alive reuse and triggered MaxListenersExceededWarning at ≥11 redirects. — [lib/adapters/http.js#L64-L82](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L64-L82) [lib/adapters/http.js#L1337-L1378](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1337-L1378)
- `tunnelingAgentCache` is a module-level unbounded `Map` keyed by proxy config; the code comments argue the keyspace is bounded in practice, which is an assumption rather than an enforced limit. — [lib/adapters/http.js#L84-L136](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L84-L136)
- Browser-safety depends entirely on the package.json alias map, not on code: `lib/helpers/Http2Sessions.js` carries an explicit comment that it must never be imported from a browser-reachable path because only `lib/adapters/http.js` is aliased to `lib/helpers/null.js`. — [lib/helpers/Http2Sessions.js#L1-L8](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/Http2Sessions.js#L1-L8) [package.json#L52-L58](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L52-L58)
- The `./unsafe/*` export map exposes `lib/*` wholesale to consumers (plus named `unsafe/core/settle.js`, `unsafe/helpers/buildURL.js`, `unsafe/utils.js`, etc.), so any internal helper is effectively public API and refactors there can break downstream users despite the `unsafe` prefix. — [package.json#L34-L44](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L34-L44)
- Legacy/compat surface that is easy to break silently: `axios.Cancel` aliases `CanceledError`, `CancelToken.promise.then` is monkey-patched to return a cancellable promise, `transitional.legacyInterceptorReqResOrdering` defaults to `true`, and stale configs `tslint.json` and `webpack.config.js` remain at repo root with no referencing script. (inferred) — [lib/axios.js#L59-L60](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/axios.js#L59-L60) [lib/cancel/CancelToken.js#L38-L52](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/cancel/CancelToken.js#L38-L52) [lib/defaults/transitional.js#L7](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/transitional.js#L7) [tslint.json](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tslint.json) [webpack.config.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/webpack.config.js)
- The `moderator.yml` workflow grants `issues: write`, `pull-requests: write`, and `models: read` to a third-party AI moderation action on every issue and comment event — the broadest write permission set of any workflow in the repo. — [.github/workflows/moderator.yml#L1-L30](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/moderator.yml#L1-L30)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)