# Axios v1.15.1

- Product: Axios (https://whatsnew.fyi/product/axios)
- Vendor: Axios
- Date: 2026-04-19
- Version: v1.15.1
- Original notes: https://github.com/axios/axios/releases/tag/v1.15.1
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.15.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Tightened validation and sanitisation across request header construction to close the header-injection attack surface
- **security** — Correctly strip CR/LF from multipart header values to prevent injection via field names and filenames
- **security** — Replace unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects
- **security** — Short-circuit `withXSRFToken` on any truthy non-boolean value to prevent silent leakage of XSRF token cross-origin
- **security** — Enforce `maxBodyLength` even when `maxRedirects` is set to 0
- **security** — Apply `maxContentLength` to streamed responses that previously bypassed the cap
- **security** — Complete an earlier incomplete CVE fix to fully close the regression window
- **added** — Add initial scaffold for AI-assisted translations of the documentation site
- **added** — Add `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests
- **fixed** — Remove `Content-Type` when no boundary is present on `FormData` fetch requests
- **fixed** — Support multi-select fields in FormData handling
- **fixed** — Cancel `request.body` instead of the source stream on fetch abort
- **fixed** — Fix recursion bug in form-data serialisation
- **fixed** — Handle socket-only request errors without leaking keep-alive listeners in HTTP adapter
- **fixed** — Clamp `loaded` to `total` for computable upload/download progress events
- **fixed** — Align `runWhen` type with the runtime behaviour in `InterceptorManager`
- **fixed** — Make response header keys case-insensitive
- **fixed** — Use strict equality in the `buildFullPath` base/relative URL check
- **fixed** — Improve the regex used for `AxiosURLSearchParams` param serialisation to avoid edge-case mismatches
- **fixed** — Parse out header/config values instead of throwing on malformed input

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

##### 🔒 Security Fixes

* **Header Injection Hardening:** Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (__#10749__)
* **CRLF Stripping in Multipart Headers:** Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (__#10758__)
* **Prototype Pollution / Auth Bypass:** Replaced unsafe `in` checks with `hasOwnProperty` to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (__#10761__, __#10760__)
* **`withXSRFToken` Truthy Bypass:** Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (__#10762__)
* **`maxBodyLength` With Zero Redirects:** Enforces `maxBodyLength` even when `maxRedirects` is set to `0`, closing a bypass path for oversized request bodies. (__#10753__)
* **Streamed Response `maxContentLength` Bypass:** Applies `maxContentLength` to streamed responses that previously bypassed the cap. (__#10754__)
* **Follow-up CVE Completion:** Completes an earlier incomplete CVE fix to fully close the regression window. (__#10755__)

##### 🚀 New Features

* **AI-Based Docs Translations:** Initial scaffold for AI-assisted translations of the documentation site. (__#10705__)
* **`Location` Request Header Type:** Adds `Location` to `CommonRequestHeadersList` for accurate typing of redirect-aware requests. (__#7528__)

##### 🐛 Bug Fixes

* **FormData Handling:** Removes `Content-Type` when no boundary is present on `FormData` fetch requests, supports multi-select fields, cancels `request.body` instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (__#7314__, __#10676__, __#10702__, __#10726__)
* **HTTP Adapter:** Handles socket-only request errors without leaking keep-alive listeners. (__#10576__)
* **Progress Events:** Clamps `loaded` to `total` for computable upload/download progress events. (__#7458__)
* **Types:** Aligns `runWhen` type with the runtime behaviour in `InterceptorManager` and makes response header keys case-insensitive. (__#7529__, __#10677__)
* **`buildFullPath`:** Uses strict equality in the base/relative URL check. (__#7252__)
* **`AxiosURLSearchParams` Regex:** Improves the regex used for param serialisation to avoid edge-case mismatches. (__#10736__)
* **Resilient Value Parsing:** Parses out header/config values instead of throwing on malformed input. (__#10687__)
* **Docs Artefact Cleanup:** Removes the docs content that was incorrectly committed. (__#10727__)

##### 🔧 Maintenance & Chores

* **Threat Model & Security Docs:** Ongoing refinement of `THREATMODEL.md`, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (__#10672__, __#10715__, __#10718__, __#10722__, __#10763__, __#10765__)
* **Test Coverage & Migration:** Expanded `shouldBypassProxy` coverage for wildcard/IPv6/edge cases, documented and tested `AxiosError.status`, and migrated `progressEventReducer` tests to Vitest. (__#10723__, __#10725__, __#10741__)
* **Type Refactor:** Uses TypeScript utility types to deduplicate literal unions. (__#7520__)
* **Repo & CI:** Adds `CODEOWNERS`, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (__#10739__, __#10738__, __#10746__)
* **Changelog Backfill:** Added missing version entries to the changelog. (__#10704__)
* **Dependencies:** Bumped `follow-redirects` (`1.15.11` → `1.16.0`) in root and docs, `axios` (`1.14.0` → `1.15.0`) in docs, and a group of 5 development dependencies. (__#10717__, __#10716__, _

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.15.1]_