CVE-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Exploit for CVE-2026-63292

⚠️ CVE-2026-63292 — Apache HTTP Server Security Vulnerability...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

axios: axios: Request socket hijacking via inherited createConnection property

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: axios: Request socket hijacking via inherited createConnection property

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: Axios: HTTP header injection via inherited prototype properties

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...