# Axios v1.16.0

- Product: Axios (https://whatsnew.fyi/product/axios)
- Vendor: Axios
- Date: 2026-05-02
- Version: v1.16.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.16.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.16.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support for the QUERY HTTP method across adapters and type definitions
- **added** — ECONNREFUSED error constant exposed on AxiosError for matching connection-refused failures
- **added** — Export the internal encode helper from buildURL for userland param serializers
- **security** — Fetch adapter now enforces maxBodyLength and maxContentLength limits
- **changed** — Proxy requests now preserve user-supplied Host headers
- **changed** — Basic auth credentials embedded in URLs are now URL-decoded
- **changed** — parseProtocol now strictly requires a colon in the protocol separator
- **changed** — Replaced deprecated unescape() with modern UTF-8 encoding for non-ASCII URL handling
- **fixed** — HTTP adapter cleared stale headers when a redirect targets a no-proxy host
- **fixed** — HTTP adapter fixed the redirect listener chain to prevent stacking across hops
- **fixed** — HTTP adapter restored the missing requestDetails argument on beforeRedirect
- **fixed** — HTTP adapter preserved partial response object on AxiosError when a stream is aborted after headers arrive
- **fixed** — HTTP adapter honoured the timeout option during the connect phase when redirects are disabled
- **fixed** — HTTP adapter resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0
- **fixed** — Fetch adapter set the User-Agent header to match the HTTP adapter
- **fixed** — Fetch adapter preserved the original abort reason instead of replacing it with a generic error
- **fixed** — Fetch adapter deferred global access so importing the module no longer throws a TypeError in restricted environments
- **fixed** — XHR adapter unsubscribed cancelToken and AbortSignal listeners on error, timeout, and abort code paths to prevent leaked subscriptions
- **fixed** — Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest

##### v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new `ECONNREFUSED` error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

##### ⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

- **Fetch adapter now enforces `maxBodyLength` and `maxContentLength`.** These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (**#10795**)
- **Proxy requests now preserve user-supplied `Host` headers.** Previously, the proxy path could overwrite a custom `Host`. Virtual-host-style routing through a proxy will now behave correctly. (**#10822**)
- **Basic auth credentials embedded in URLs are now URL-decoded.** If you have percent-encoded credentials in a URL (e.g. `https://user:p%40ss@host`), the decoded value is what now goes on the wire. (**#10825**)
- **`parseProtocol` now strictly requires a colon in the protocol separator.** Strings that loosely parsed as protocols before may no longer match. (**#10729**)
- **Deprecated `unescape()` replaced with modern UTF-8 encoding.** Non-ASCII URL handling is now spec-correct; consumers depending on legacy `unescape()` quirks may see different output bytes. (**#7378**)
- **`transformRequest` input typing change was reverted.** The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (**#10745**, **#10810**)

##### 🚀 New Features

- **QUERY HTTP Method:** Added support for the QUERY HTTP method across adapters and type definitions. (**#10802**)
- **ECONNREFUSED Error Constant:** Exposed `ECONNREFUSED` as a constant on `AxiosError` so callers can match connection-refused failures without comparing string literals (closes #6485). (**#10680**)
- **Encode Helper Export:** Exported the internal `encode` helper from `buildURL` so userland param serializers can reuse the same encoding logic that axios uses internally. (**#6897**)

##### 🐛 Bug Fixes

- **HTTP Adapter — Redirects & Headers:** Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing `requestDetails` argument on `beforeRedirect`, preserved user-supplied `Host` headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (**#10794**, **#10800**, **#6241**, **#10822**, **#10825**)
- **HTTP Adapter — Streams & Timeouts:** Preserved the partial response object on `AxiosError` when a stream is aborted after headers arrive, honoured the `timeout` option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and `maxRedirects: 0`. (**#10708**, **#10819**, **#7149**)
- **Fetch Adapter:** Enforced `maxBodyLength` / `maxContentLength` in the fetch adapter, set the `User-Agent` header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a `TypeError` in restricted environments. (**#10795**, **#10772**, **#10806**, **#7260**)
- **XHR Adapter:** Unsubscribed the `cancelToken` and `AbortSignal` listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (**#10787**)
- **Error Handling:** Attached the parsed response to `AxiosError` when `JSON.parse` fails inside `dispatchRequest`, prevented `settle` from emitting `undefined` error codes, and tightened the `parseProtocol` regex to require a colon in the protocol separator. (**#10724**, **#7276**, **#10729**)
- **Types & Exports:** Aligned the CommonJS `CancelToken` typings with the ESM build

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.16.0]_