# Axios v1.19.0

- Product: Axios (https://whatsnew.fyi/product/axios)
- Vendor: Axios
- Date: 2026-07-26
- Version: v1.19.0
- Original notes: https://github.com/axios/axios/releases/tag/v1.19.0
- Permalink: https://whatsnew.fyi/product/axios/releases/v1.19.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Raised the form-data dependency floor to ^4.0.6 to prevent fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx
- **added** — Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers
- **added** — Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing
- **added** — Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status code and matching ESM/CJS declarations
- **fixed** — Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys
- **fixed** — Removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills
- **fixed** — Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching
- **fixed** — Honored * entries within comma- or space-separated bypass lists in NO_PROXY matching
- **fixed** — Propagated already-aborted input signals immediately when composing abort signals
- **fixed** — Preserved empty first values for duplicate singleton headers
- **fixed** — Made AxiosHeaders#getSetCookie() consistently return arrays for present values
- **fixed** — Included normalized, safely redacted offending URLs in malformed-protocol errors
- **fixed** — Removed repeated trailing slashes when combining base URLs
- **fixed** — Clamped malformed negative progress values to zero
- **fixed** — Ensured final Node.js download progress events are delivered before streamed responses close
- **fixed** — Serialized Set values as arrays in JSON-compatible snapshots
- **fixed** — Synthesized useful AxiosError messages from otherwise-empty AggregateError instances
- **fixed** — Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters
- **fixed** — Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully

##### v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

##### 🔒 Security Fixes

- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)

##### 🚀 New Features

- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
  adapters, and serializers. (#11043, #11081)
- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

##### 🐛 Bug Fixes

- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

##### 🔧 Maintenance & Chores

- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

##### 🌟 New Contributors

We are thrilled to welcome our new contrib

_[Truncated at 4000 characters — full notes: https://github.com/axios/axios/releases/tag/v1.19.0]_