# Axios v0.32.0

- Product: Axios (https://whatsnew.fyi/product/axios)
- Vendor: Axios
- Date: 2026-05-04
- Version: v0.32.0
- Original notes: https://github.com/axios/axios/releases/tag/v0.32.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v0.32.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs, configurable via config.redact
- **security** — Cookie names are read literally rather than via regex and only own properties are respected when evaluating withXSRFToken
- **security** — NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1
- **security** — Node http adapter strips Proxy-Authorization when no proxy is in use
- **security** — Node http adapter gates socketPath behind a new allowedSocketPaths allowlist to reduce accidental Unix socket exposure
- **security** — Browser xhr adapter enforces stricter own-property checks when reading config and headers
- **security** — AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout
- **changed** — mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets
- **added** — Add formDataHeaderPolicy, redact, and allowedSocketPaths to TypeScript declarations with runtime defaults

##### v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

##### ⚠️ Breaking Changes & Deprecations

- Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

##### 🔒 Security Fixes

- Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
- Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
- Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
- Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
- Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
- URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
- Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

##### 🔧 Maintenance & Chores

- Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

[**Full Changelog**](https://github.com/axios/axios/compare/v0.31.1...v0.32.0)