# Axios changelog

> A promise-based HTTP client for the browser and Node.js.

- Vendor: Axios
- Category: Frameworks & Libraries
- Official site: https://axios-http.com
- Tracked by: What's New (https://whatsnew.fyi/product/axios)
- Harvested from: GitHub (axios/axios)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.19.0

- Date: 2026-07-26
- Version: v1.19.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.19.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.19.0

- **security** — Raised the form-data dependency floor to ^4.0.6 to prevent fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx
- **added** — Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers
- **added** — Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing
- **added** — Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status code and matching ESM/CJS declarations
- **fixed** — Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys
- **fixed** — Removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills
- **fixed** — Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching
- **fixed** — Honored * entries within comma- or space-separated bypass lists in NO_PROXY matching
- **fixed** — Propagated already-aborted input signals immediately when composing abort signals
- **fixed** — Preserved empty first values for duplicate singleton headers
- **fixed** — Made AxiosHeaders#getSetCookie() consistently return arrays for present values
- **fixed** — Included normalized, safely redacted offending URLs in malformed-protocol errors
- **fixed** — Removed repeated trailing slashes when combining base URLs
- **fixed** — Clamped malformed negative progress values to zero
- **fixed** — Ensured final Node.js download progress events are delivered before streamed responses close
- **fixed** — Serialized Set values as arrays in JSON-compatible snapshots
- **fixed** — Synthesized useful AxiosError messages from otherwise-empty AggregateError instances
- **fixed** — Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters
- **fixed** — Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully

##### v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

##### 🔒 Security Fixes

- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)

##### 🚀 New Features

- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
  adapters, and serializers. (#11043, #11081)
- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

##### 🐛 Bug Fixes

- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

##### 🔧 Maintenance & Chores

- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

##### 🌟 New Contributors

We are thrilled to welcome our new contrib

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.19.0]_

### v1.18.1

- Date: 2026-06-21
- Version: v1.18.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.18.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.18.1

- **fixed** — Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes
- **fixed** — Guarded socket.setKeepAlive for proxy agent streams in Node HTTP adapter
- **fixed** — Accepted path-only URLs when socketPath is configured in Node HTTP adapter
- **fixed** — Deferred environment proxy handling to Node in HTTP adapter
- **fixed** — Explicitly passed maxBodyLength through to follow-redirects in Node HTTP adapter
- **fixed** — Fixed runtime crashes and type definition mismatches in runtime and type correctness
- **fixed** — Fixed incorrect error handling paths
- **fixed** — Switched AxiosURLSearchParams encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly
- **changed** — Documented sensitive headers and status transition behaviour

##### v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

##### 🐛 Bug Fixes

- AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
- Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
- Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
- AxiosURLSearchParams: Switched the encoder callback to an arrow function so `encoder.call(this)` receives the `AxiosURLSearchParams` instance correctly. (#11019)

##### 🔧 Maintenance & Chores

- Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

- Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

- @webdevelopersrinu (#10913)
- @sijie-Z (#10993)
- @bartlomieju (#11023)
- @JSap0914 (#11019)

[Full Changelog](https://github.com/axios/axios/compare/v1.18.0...v1.18.1)

### v1.18.0

- Date: 2026-06-13
- Version: v1.18.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.18.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.18.0

- **security** — Add Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects to prevent custom auth headers such as API keys from leaking to another origin
- **security** — Reject malformed http: and https: URLs that omit // with ERR_INVALID_URL, and tighten prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching
- **added** — Add transitional.validateStatusUndefinedResolves option so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status

##### v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

##### 🔒 Security Fixes

* **Redirect Header Safety:** Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (__#10892__)

* **URL And Request Hardening:** Rejects malformed `http:` and `https:` URLs that omit `//` with `ERR_INVALID_URL`, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local `NO_PROXY` matching. (__#11000__)

##### 🐛 Bug Fixes

* **Status Validation:** Added `transitional.validateStatusUndefinedResolves` so applications can opt in to treating `validateStatus: undefined` like the option was omitted, while `validateStatus: null` remains the explicit way to accept every status. (__#10899__)

##### 🔧 Maintenance & Chores

* **Documentation:** Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the `proxy` request config as Node.js-only in the advanced docs. (__#10984__, __#10988__, __#10992__, __#10995__)

* **Dependencies:** Bumped `@babel/core`, `@babel/preset-env`, `@commitlint/cli`, `@commitlint/config-conventional`, `@rollup/plugin-babel`, `@rollup/plugin-commonjs`, `@vitest/browser`, `@vitest/browser-playwright`, `eslint`, `lint-staged`, `rollup`, `vitest`, and `actions/checkout`. (__#10989__, __#10996__, __#10997__)

* **Release Metadata:** Prepared the 1.18.0 release by updating package metadata and the runtime `VERSION` value. (__#11003__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@drori12__ (__#10984__)
* __@eyupcanakman__ (__#10899__)
* __@Adi-Beker__ (__#10995__)

[Full Changelog](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)

### v0.33.0

- Date: 2026-06-13
- Version: v0.33.0
- Original notes: https://github.com/axios/axios/releases/tag/v0.33.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v0.33.0

- **security** — Use own-property reads for nested request options affecting auth, params, proxy, and data handling
- **security** — Add bounded form serialisation depth checks
- **security** — Normalise nullish Basic Auth credentials
- **security** — Treat 0.0.0.0 as local for proxy bypass
- **added** — Add Node.js 26 to the v0.x CI and release/publish matrices
- **changed** — Adopt npm staged publishing for v0.x releases
- **changed** — Disable npm caching in CI to make installs and publish jobs more deterministic

##### v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

##### 🔒 Security Fixes

* **Request Config Hardening:** Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats `0.0.0.0` as local for proxy bypass. (__#11001__)

##### 🚀 New Features

* **Node.js 26:** Adds Node.js 26 to the v0.x CI and release/publish matrices. (__#10937__)

##### 🔧 Maintenance & Chores

* **Release Publishing:** Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (__#10936__, __#10943__)
* **Changelog:** Backfills missing v0.x changelog entries for prior releases. (__#10842__)
* **Release Metadata:** Bumps package and internal version metadata for v0.33.0. (__#11002__)

[Full Changelog](https://github.com/axios/axios/compare/v0.32.0...v0.33.0)

### v1.17.0

- Date: 2026-06-03
- Version: v1.17.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.17.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.17.0

- **security** — Guard socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths
- **security** — Switch the publish workflow to npm staged publishing for safer, auditable package releases with provenance
- **added** — Add Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding
- **fixed** — Restore Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and align the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth
- **fixed** — Preserve user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies
- **fixed** — Clear default Content-Type for React Native FormData so multipart boundaries can be generated correctly
- **fixed** — Silently skip empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes
- **fixed** — Preserve enumerable symbol keys when cloning plain request data through axios merge logic
- **fixed** — Convert resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures
- **fixed** — Correct AxiosHeaders.toJSON() return types and update CommonJS isCancel typings to narrow to CanceledError<T>
- **fixed** — Avoid emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset

##### v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

##### 🔒 Security Fixes

* **Config Hardening:** Guarded `socketPath`, `params`, and `paramsSerializer` reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (__#10901__, __#10922__)
* **Release Publishing:** Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (__#10926__)

##### 🚀 New Features

* **HTTP Compression:** Added Node HTTP adapter support for zstd response decompression, with `transitional.advertiseZstdAcceptEncoding` controlling whether `zstd` is advertised in `Accept-Encoding`. (__#6792__, __#10920__)

##### 🐛 Bug Fixes

* **Authentication Handling:** Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (__#10929__, __#10896__)
* **Proxy TLS:** Preserved user `httpsAgent` TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (__#10957__)
* **React Native FormData:** Cleared default `Content-Type` for React Native `FormData` so multipart boundaries can be generated correctly. (__#10898__)
* **Headers:** Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (__#10875__)
* **Request Data Merging:** Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (__#10812__)
* **Bundler Compatibility:** Converted `resolveConfig` from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (__#10891__)
* **Types:** Corrected `AxiosHeaders.toJSON()` return types and updated CommonJS `isCancel` typings to narrow to `CanceledError<T>`. (__#10956__, __#10952__)
* **Build Tooling:** Avoided emitting a null `Authorization` header from the GitHub build helper when `GITHUB_TOKEN` is unset. (__#10931__)

##### 🔧 Maintenance & Chores

* **HTTP/2 Internals:** Extracted `Http2Sessions` into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (__#10861__)
* **Package Publishing:** Reduced published package size by switching to a `files` allowlist and dropping unneeded unminified bundle source maps. (__#10939__)
* **CI and Release Automation:** Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (__#10907__, __#10911__, __#10916__, __#10927__, __#10935__, __#10983__)
* **Developer Workflow:** Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (__#10925__, __#10914__, __#10958__)
* **Documentation and Policy:** Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (__#10890__, __#10889__, __#10921__, __#10945__, __#10905__, __#10933__, __#10915__, __#10887__, __#10955__)
* **Dependencies:** Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, `fs-extra`, `qs`, docs dependencies, and GitHub Actions dependencies including `actions/dependency-review-action` and `zizmorcore/zizmor-action`. (__#10871__, __#10879__, __#10918__, __#10919__, __#10934__, __#10947__, __#10954__, __#10960__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@BasixKOR__ (__#6792__)
* __@carladams1299-lab__ (__#10861__)
* __@LaplaceYoung__ (__#10812__)
* __@JamieMagee__ (__#10939__)
* __@RonGamzu__ (__#10905__)
* __@sapirbaruch__ (_

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.17.0]_

### v1.16.1

- Date: 2026-05-13
- Version: v1.16.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.16.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.16.1

- **security** — Hardened formDataToJSON against prototype pollution by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization
- **security** — Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations
- **security** — Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline
- **fixed** — Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling
- **fixed** — Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch
- **fixed** — Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid
- **fixed** — Fixed an unexpected token error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users
- **fixed** — Made parseReviver context.source optional in the type definitions to align with the ES2023 specification
- **removed** — Reverted support for passing a URL object as config.url due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed
- **changed** — Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures
- **changed** — Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path
- **changed** — Bumped @commitlint/cli from 20.5.0 to 20.5.2

##### v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in `formDataToJSON`, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

##### 🔒 Security Fixes

* **Prototype Pollution Defence-in-Depth:** Hardened `formDataToJSON` against already-polluted `Object.prototype` by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (__#7413__)
* **Proxy Cleartext Leak:** Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (__#10858__)
* **CI Cache Removal:** Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (__#10882__)

##### 🐛 Bug Fixes

* **Data URI Parsing:** Updated the `fromDataURI` regex to match RFC 2397 more strictly, fixing edge cases in `data:` URL handling. (__#10829__)
* **Unicode Headers:** Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (__#10850__)
* **XHR Upload Progress:** Guarded against malformed `ProgressEvent` payloads emitted by some environments during XHR upload, preventing crashes when `loaded` / `total` are missing or invalid. (__#10868__)
* **Webpack 4 Fetch Adapter:** Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (__#10864__)
* **Type Definitions:** Made `parseReviver` `context.source` optional in the type definitions to align with the ES2023 specification. (__#10837__)
* **URL Object Support Reverted:** Reverted the change that allowed passing a `URL` object as `config.url` (originally __#10866__) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (__#10874__)

##### 🔧 Maintenance & Chores

* **Cycle Detection Refactor:** Replaced the array-based cycle tracker in `toJSONObject` with a `WeakSet`, improving performance and memory behaviour on large nested structures. (__#10832__)
* **composeSignals Cleanup:** Refactored `composeSignals` to use a clearer early-return structure, simplifying the cancellation/abort composition path. (__#10844__)
* **AI Readiness & Repo Docs:** Added `AGENTS.md` and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (__#10835__, __#10841__)
* **Docs Improvements:** Clarified the GET request example, fixed the interceptor `eject` example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (__#10836__, __#10853__, __#10856__)
* **Sponsorship Tooling:** Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (__#10843__, __#10859__, __#10869__)
* **Dependencies:** Bumped `@commitlint/cli` from 20.5.0 to 20.5.2. (__#10846__)

##### 🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

* __@hpinmetaverse__ (__#10836__)
* __@tommyhgunz14__ (__#7413__)
* __@abhu85__ (__#10829__)
* __@divyanshuraj1095__ (__#10853__)
* __@sagodi97__ (__#10856__)
* __@rkdfx__ (__#10868__)
* __@Liuwei1125__ (__#10866__)

[Full Changelog](https://github.com/axios/axios/compare/v1.16.0...v1.16.1)

### v0.32.0

- Date: 2026-05-04
- Version: v0.32.0
- Original notes: https://github.com/axios/axios/releases/tag/v0.32.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v0.32.0

- **security** — AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs, configurable via config.redact
- **security** — Cookie names are read literally rather than via regex and only own properties are respected when evaluating withXSRFToken
- **security** — NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1
- **security** — Node http adapter strips Proxy-Authorization when no proxy is in use
- **security** — Node http adapter gates socketPath behind a new allowedSocketPaths allowlist to reduce accidental Unix socket exposure
- **security** — Browser xhr adapter enforces stricter own-property checks when reading config and headers
- **security** — AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout
- **changed** — mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets
- **added** — Add formDataHeaderPolicy, redact, and allowedSocketPaths to TypeScript declarations with runtime defaults

##### v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

##### ⚠️ Breaking Changes & Deprecations

- Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

##### 🔒 Security Fixes

- Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
- Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
- Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
- Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
- Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
- URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
- Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

##### 🔧 Maintenance & Chores

- Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

[**Full Changelog**](https://github.com/axios/axios/compare/v0.31.1...v0.32.0)

### v1.16.0

- Date: 2026-05-02
- Version: v1.16.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.16.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.16.0

- **added** — Support for the QUERY HTTP method across adapters and type definitions
- **added** — ECONNREFUSED error constant exposed on AxiosError for matching connection-refused failures
- **added** — Export the internal encode helper from buildURL for userland param serializers
- **security** — Fetch adapter now enforces maxBodyLength and maxContentLength limits
- **changed** — Proxy requests now preserve user-supplied Host headers
- **changed** — Basic auth credentials embedded in URLs are now URL-decoded
- **changed** — parseProtocol now strictly requires a colon in the protocol separator
- **changed** — Replaced deprecated unescape() with modern UTF-8 encoding for non-ASCII URL handling
- **fixed** — HTTP adapter cleared stale headers when a redirect targets a no-proxy host
- **fixed** — HTTP adapter fixed the redirect listener chain to prevent stacking across hops
- **fixed** — HTTP adapter restored the missing requestDetails argument on beforeRedirect
- **fixed** — HTTP adapter preserved partial response object on AxiosError when a stream is aborted after headers arrive
- **fixed** — HTTP adapter honoured the timeout option during the connect phase when redirects are disabled
- **fixed** — HTTP adapter resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0
- **fixed** — Fetch adapter set the User-Agent header to match the HTTP adapter
- **fixed** — Fetch adapter preserved the original abort reason instead of replacing it with a generic error
- **fixed** — Fetch adapter deferred global access so importing the module no longer throws a TypeError in restricted environments
- **fixed** — XHR adapter unsubscribed cancelToken and AbortSignal listeners on error, timeout, and abort code paths to prevent leaked subscriptions
- **fixed** — Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest

##### v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new `ECONNREFUSED` error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

##### ⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

- **Fetch adapter now enforces `maxBodyLength` and `maxContentLength`.** These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (**#10795**)
- **Proxy requests now preserve user-supplied `Host` headers.** Previously, the proxy path could overwrite a custom `Host`. Virtual-host-style routing through a proxy will now behave correctly. (**#10822**)
- **Basic auth credentials embedded in URLs are now URL-decoded.** If you have percent-encoded credentials in a URL (e.g. `https://user:p%40ss@host`), the decoded value is what now goes on the wire. (**#10825**)
- **`parseProtocol` now strictly requires a colon in the protocol separator.** Strings that loosely parsed as protocols before may no longer match. (**#10729**)
- **Deprecated `unescape()` replaced with modern UTF-8 encoding.** Non-ASCII URL handling is now spec-correct; consumers depending on legacy `unescape()` quirks may see different output bytes. (**#7378**)
- **`transformRequest` input typing change was reverted.** The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (**#10745**, **#10810**)

##### 🚀 New Features

- **QUERY HTTP Method:** Added support for the QUERY HTTP method across adapters and type definitions. (**#10802**)
- **ECONNREFUSED Error Constant:** Exposed `ECONNREFUSED` as a constant on `AxiosError` so callers can match connection-refused failures without comparing string literals (closes #6485). (**#10680**)
- **Encode Helper Export:** Exported the internal `encode` helper from `buildURL` so userland param serializers can reuse the same encoding logic that axios uses internally. (**#6897**)

##### 🐛 Bug Fixes

- **HTTP Adapter — Redirects & Headers:** Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing `requestDetails` argument on `beforeRedirect`, preserved user-supplied `Host` headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (**#10794**, **#10800**, **#6241**, **#10822**, **#10825**)
- **HTTP Adapter — Streams & Timeouts:** Preserved the partial response object on `AxiosError` when a stream is aborted after headers arrive, honoured the `timeout` option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and `maxRedirects: 0`. (**#10708**, **#10819**, **#7149**)
- **Fetch Adapter:** Enforced `maxBodyLength` / `maxContentLength` in the fetch adapter, set the `User-Agent` header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a `TypeError` in restricted environments. (**#10795**, **#10772**, **#10806**, **#7260**)
- **XHR Adapter:** Unsubscribed the `cancelToken` and `AbortSignal` listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (**#10787**)
- **Error Handling:** Attached the parsed response to `AxiosError` when `JSON.parse` fails inside `dispatchRequest`, prevented `settle` from emitting `undefined` error codes, and tightened the `parseProtocol` regex to require a colon in the protocol separator. (**#10724**, **#7276**, **#10729**)
- **Types & Exports:** Aligned the CommonJS `CancelToken` typings with the ESM build

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.16.0]_

### v1.15.2

- Date: 2026-04-21
- Version: v1.15.2
- Original notes: https://github.com/axios/axios/releases/tag/v1.15.2
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.15.2

- **security** — Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests
- **security** — Reject non-string socketPath values and add an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch
- **security** — Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md and THREATMODEL.md with provenance verification, 60-day resolution policy, and maintainer incident-response runbook
- **added** — Add allowedSocketPaths config option to allowlist Unix domain socket paths used by the Node http adapter
- **fixed** — Install a single per-socket error listener tracking the active request via kAxiosSocketListener and kAxiosCurrentReq, eliminating per-request listener accumulation and linear heap growth under concurrent or long-running keep-alive workloads

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in `allowedSocketPaths` allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

##### 🔒 Security Fixes

- **Prototype Pollution Hardening (HTTP Adapter):** Hardened the Node HTTP adapter and `resolveConfig`/`mergeConfig`/validator paths to read only own properties and use null-prototype config objects, preventing polluted `auth`, `baseURL`, `socketPath`, `beforeRedirect`, and `insecureHTTPParser` from influencing requests. (**#10779**)
- **SSRF via `socketPath`:** Rejects non-string `socketPath` values and adds an opt-in `allowedSocketPaths` config option to restrict permitted Unix domain socket paths, returning `AxiosError` `ERR_BAD_OPTION_VALUE` on mismatch. (**#10777**)
- **Supply-chain Hardening:** Added `.npmrc` with `ignore-scripts=true`, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded `SECURITY.md`/`THREATMODEL.md` with provenance verification (`npm audit signatures`), 60-day resolution policy, and maintainer incident-response runbook. (**#10776**)

##### 🚀 New Features

- **`allowedSocketPaths` Config Option:** New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (**#10777**)

##### 🐛 Bug Fixes

- **Keep-alive Socket Memory Leak:** Installs a single per-socket `error` listener tracking the active request via `kAxiosSocketListener`/`kAxiosCurrentReq`, eliminating per-request listener accumulation, `MaxListenersExceededWarning`, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (**#10788**)

##### 🔧 Maintenance & Chores

- **Changelog:** Updated `CHANGELOG.md` with v1.15.1 release notes. (**#10781**)

[Full Changelog](https://github.com/axios/axios/compare/v1.15.1...v1.15.2)

### v1.15.1

- Date: 2026-04-19
- Version: v1.15.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.15.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.15.1

- **security** — Tightened validation and sanitisation across request header construction to close the header-injection attack surface
- **security** — Correctly strip CR/LF from multipart header values to prevent injection via field names and filenames
- **security** — Replace unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects
- **security** — Short-circuit `withXSRFToken` on any truthy non-boolean value to prevent silent leakage of XSRF token cross-origin
- **security** — Enforce `maxBodyLength` even when `maxRedirects` is set to 0
- **security** — Apply `maxContentLength` to streamed responses that previously bypassed the cap
- **security** — Complete an earlier incomplete CVE fix to fully close the regression window
- **added** — Add initial scaffold for AI-assisted translations of the documentation site
- **added** — Add `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests
- **fixed** — Remove `Content-Type` when no boundary is present on `FormData` fetch requests
- **fixed** — Support multi-select fields in FormData handling
- **fixed** — Cancel `request.body` instead of the source stream on fetch abort
- **fixed** — Fix recursion bug in form-data serialisation
- **fixed** — Handle socket-only request errors without leaking keep-alive listeners in HTTP adapter
- **fixed** — Clamp `loaded` to `total` for computable upload/download progress events
- **fixed** — Align `runWhen` type with the runtime behaviour in `InterceptorManager`
- **fixed** — Make response header keys case-insensitive
- **fixed** — Use strict equality in the `buildFullPath` base/relative URL check
- **fixed** — Improve the regex used for `AxiosURLSearchParams` param serialisation to avoid edge-case mismatches
- **fixed** — Parse out header/config values instead of throwing on malformed input

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

##### 🔒 Security Fixes

* **Header Injection Hardening:** Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (__#10749__)
* **CRLF Stripping in Multipart Headers:** Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (__#10758__)
* **Prototype Pollution / Auth Bypass:** Replaced unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (__#10761__, __#10760__)
* **`withXSRFToken` Truthy Bypass:** Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (__#10762__)
* **`maxBodyLength` With Zero Redirects:** Enforces `maxBodyLength` even when `maxRedirects` is set to `0`, closing a bypass path for oversized request bodies. (__#10753__)
* **Streamed Response `maxContentLength` Bypass:** Applies `maxContentLength` to streamed responses that previously bypassed the cap. (__#10754__)
* **Follow-up CVE Completion:** Completes an earlier incomplete CVE fix to fully close the regression window. (__#10755__)

##### 🚀 New Features

* **AI-Based Docs Translations:** Initial scaffold for AI-assisted translations of the documentation site. (__#10705__)
* **`Location` Request Header Type:** Adds `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests. (__#7528__)

##### 🐛 Bug Fixes

* **FormData Handling:** Removes `Content-Type` when no boundary is present on `FormData` fetch requests, supports multi-select fields, cancels `request.body` instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (__#7314__, __#10676__, __#10702__, __#10726__)
* **HTTP Adapter:** Handles socket-only request errors without leaking keep-alive listeners. (__#10576__)
* **Progress Events:** Clamps `loaded` to `total` for computable upload/download progress events. (__#7458__)
* **Types:** Aligns `runWhen` type with the runtime behaviour in `InterceptorManager` and makes response header keys case-insensitive. (__#7529__, __#10677__)
* **`buildFullPath`:** Uses strict equality in the base/relative URL check. (__#7252__)
* **`AxiosURLSearchParams` Regex:** Improves the regex used for param serialisation to avoid edge-case mismatches. (__#10736__)
* **Resilient Value Parsing:** Parses out header/config values instead of throwing on malformed input. (__#10687__)
* **Docs Artefact Cleanup:** Removes the docs content that was incorrectly committed. (__#10727__)

##### 🔧 Maintenance & Chores

* **Threat Model & Security Docs:** Ongoing refinement of `THREATMODEL.md`, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (__#10672__, __#10715__, __#10718__, __#10722__, __#10763__, __#10765__)
* **Test Coverage & Migration:** Expanded `shouldBypassProxy` coverage for wildcard/IPv6/edge cases, documented and tested `AxiosError.status`, and migrated `progressEventReducer` tests to Vitest. (__#10723__, __#10725__, __#10741__)
* **Type Refactor:** Uses TypeScript utility types to deduplicate literal unions. (__#7520__)
* **Repo & CI:** Adds `CODEOWNERS`, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (__#10739__, __#10738__, __#10746__)
* **Changelog Backfill:** Added missing version entries to the changelog. (__#10704__)
* **Dependencies:** Bumped `follow-redirects` (`1.15.11` → `1.16.0`) in root and docs, `axios` (`1.14.0` → `1.15.0`) in docs, and a group of 5 development dependencies. (__#10717__, __#10716__, _

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.15.1]_