fix: preserve Unicode headers for request interceptors by cyphercodes · Pull Request #10850 · axios/axios

cyphercodes · 2026-05-06T03:21:09Z

Summary

Preserves Unicode request header values until request interceptors run, so callers can encode values such as Chinese names before the request is sent. The Node HTTP adapter still strips unencoded characters that Node cannot accept right before building the request options.

Linked issue

Fixes #10849

Changes

Keep non-control Unicode characters in AxiosHeaders normalization so interceptors can transform them.
Sanitize Node outbound header values to Node-compatible bytes before passing them to http.request.
Add HTTP adapter regression coverage for interceptor encoding and unencoded Unicode sanitization.

Checklist

Tests added or updated (or N/A with reason)
Docs / types updated if public API changed (index.d.ts and index.d.cts) — N/A, no public API or type changes
No breaking changes (or called out explicitly above)

Summary by cubic

Preserves non-control Unicode header values until request interceptors run, then sanitizes to byte‑safe values in http, fetch, and xhr right before sending. Centralizes faster regex-based sanitization in helpers/sanitizeHeaderValue.js.

Description

Summary of changes
- Keep non-control Unicode during AxiosHeaders normalization; still strip CR/LF to prevent injection.
- Add helpers/sanitizeHeaderValue.js with sanitizeHeaderValue, sanitizeByteStringHeaderValue, and toByteStringHeaderObject.
- Use toByteStringHeaderObject in http, fetch, and xhr adapters at send time.
- Improve performance by using regex-based sanitization and sharing logic across adapters.
Reasoning
- Lets interceptors encode values (e.g., Chinese names) while keeping adapters compliant with Node and browser header rules.
Additional context
- Fixes V1.16.0 custom request header attributes do not support Chinese. #10849.
- No public API changes.

Docs

Docs updated in /docs/pages/advanced/headers.md with a new “Unicode header values” section, explaining preservation in AxiosHeaders, adapter sanitization, and an interceptor example using encodeURIComponent. No further changes needed.

Testing

Added tests:
- http and fetch adapters: interceptor-encoded Unicode headers reach the server encoded; unencoded Unicode headers are sanitized to empty byte-safe values.
- Browser xhr: same coverage as above.
- AxiosHeaders: preserves non-control Unicode; still strips CR/LF to prevent header injection.
Coverage is sufficient; no additional tests needed.

Semantic version impact

Patch: internal bug fix and performance improvement with no breaking changes.

^{Written for commit e70b317. Summary will update on new commits.}

cubic-dev-ai

1 issue found across 3 files

Confidence score: 3/5

There is a concrete regression risk in lib/core/AxiosHeaders.js: preserving non-Latin1 Unicode header values can reach browser platform APIs that may reject them and throw when requests are sent.
The issue is moderately severe (7/10) with fairly high confidence (8/10), so this is more than a cosmetic concern and could impact real user requests at runtime.
Pay close attention to lib/core/AxiosHeaders.js - header sanitization changes may allow invalid browser header values that trigger request-time failures.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/core/AxiosHeaders.js">

<violation number="1" location="lib/core/AxiosHeaders.js:45">
P1: Header sanitization now preserves non-Latin1 Unicode values, but browser adapters pass them through to platform APIs that may reject them and throw at request time.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cyphercodes · 2026-05-06T03:47:42Z

Pushed a follow-up for the browser-adapter concern:

keeps Unicode header values available inside AxiosHeaders so request interceptors can encode them
sanitizes final adapter-bound header objects for HTTP, XHR, and fetch before platform APIs receive them
adds XHR/fetch regressions in addition to the HTTP adapter coverage

Local verification:

npx vitest run --project unit tests/unit/adapters/fetch.test.js -t "headers containing CRLF|Unicode"
npx vitest run --project unit tests/unit/adapters/http.test.js -t "headers containing CRLF|Unicode"
xvfb-run -a npx vitest run --project browser tests/browser/headers.browser.test.js -t "Unicode"
npx eslint lib/helpers/sanitizeHeaderValue.js lib/core/AxiosHeaders.js lib/adapters/http.js lib/adapters/xhr.js tests/browser/headers.browser.test.js tests/unit/adapters/fetch.test.js
git diff --check

cubic-dev-ai

1 issue found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/adapters/fetch.js">

<violation number="1" location="lib/adapters/fetch.js:288">
P2: Sanitized headers can still be overridden by the second `fetchOptions` argument when `Request` is used, defeating the new header sanitization and allowing invalid header values to re-enter the request.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-05-06T03:53:02Z

        signal: composedSignal,
        method: method.toUpperCase(),
-        headers: headers.normalize().toJSON(),
+        headers: toByteStringHeaderObject(headers.normalize()),


P2: Sanitized headers can still be overridden by the second fetchOptions argument when Request is used, defeating the new header sanitization and allowing invalid header values to re-enter the request.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/adapters/fetch.js, line 288: <comment>Sanitized headers can still be overridden by the second `fetchOptions` argument when `Request` is used, defeating the new header sanitization and allowing invalid header values to re-enter the request.</comment> <file context> @@ -284,7 +285,7 @@ const factory = (env) => { signal: composedSignal, method: method.toUpperCase(), - headers: headers.normalize().toJSON(), + headers: toByteStringHeaderObject(headers.normalize()), body: data, duplex: 'half', </file context>

jasonsaayman

lib/helpers/sanitizeHeaderValue.js:32-43: Please replace per-char concat with a regex pass for both isValidUnicodeHeaderValueChar and isValidByteStringHeaderValueChar. Same semantics but faster, and matches the prior implementation.
Can you please add a positive regression test to axiosHeaders.test.js that checks that set('x', '请求用户') roundtrips through get('x' is unchanged. Will guard against future refactoring of normalizeValue that could silently break #10849.
Would it be possible to add to /docs/ in the English docs a note about this preservation.

cyphercodes · 2026-05-06T15:47:53Z

Pushed a small follow-up for the requested sanitizer implementation change.

What changed:

Replaced the per-character header-value sanitizer loop with regex-based passes for the Unicode-preserving and ByteString/platform-bound sanitizer paths.
Kept the same trimming/control-character semantics; the intentional control-code regex ranges are documented for ESLint.

Local verification:

npm ci ✅
npx vitest run --project unit tests/unit/adapters/http.test.js -t "headers containing CRLF|Unicode" ✅
npx vitest run --project unit tests/unit/adapters/fetch.test.js -t "headers containing CRLF|Unicode" ✅
npx eslint lib/helpers/sanitizeHeaderValue.js lib/core/AxiosHeaders.js lib/adapters/http.js lib/adapters/xhr.js tests/unit/adapters/fetch.test.js ✅
git diff --check ✅

https://app.devrev.ai/devrev/issue/ASCPT-41 ![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg) <h3>Snyk has created this PR to upgrade axios from 1.16.1 to 1.17.0.</h3> :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project. <hr/> - The recommended version is **1 version** ahead of your current version. - The recommended version was released **22 days ago**. <details> <summary>Release notes</summary> <details> <summary>Package name: axios</summary> <ul> <li> 1.17.0 - <a href="https://redirect.github.com/axios/axios/releases/tag/v1.17.0">2026-06-03</a><h2>v1.17.0 — June 1, 2026</h2> This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions. <h2>🔒 Security Fixes</h2> <ul> <li>Config Hardening: Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4463370380" data-permission-text="Title is private" data-url="axios/axios#10901" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10901/hovercard" href="https://redirect.github.com/axios/axios/pull/10901">#10901</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4490479466" data-permission-text="Title is private" data-url="axios/axios#10922" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10922/hovercard" href="https://redirect.github.com/axios/axios/pull/10922">#10922</a>)</li> <li>Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496414139" data-permission-text="Title is private" data-url="axios/axios#10926" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10926/hovercard" href="https://redirect.github.com/axios/axios/pull/10926">#10926</a>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li>HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2873194565" data-permission-text="Title is private" data-url="axios/axios#6792" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/6792/hovercard" href="https://redirect.github.com/axios/axios/pull/6792">#6792</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4488098721" data-permission-text="Title is private" data-url="axios/axios#10920" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10920/hovercard" href="https://redirect.github.com/axios/axios/pull/10920">#10920</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497340497" data-permission-text="Title is private" data-url="axios/axios#10929" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10929/hovercard" href="https://redirect.github.com/axios/axios/pull/10929">#10929</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4452495512" data-permission-text="Title is private" data-url="axios/axios#10896" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10896/hovercard" href="https://redirect.github.com/axios/axios/pull/10896">#10896</a>)</li> <li>Proxy TLS: Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4542876807" data-permission-text="Title is private" data-url="axios/axios#10957" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10957/hovercard" href="https://redirect.github.com/axios/axios/pull/10957">#10957</a>)</li> <li>React Native FormData: Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4460351681" data-permission-text="Title is private" data-url="axios/axios#10898" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10898/hovercard" href="https://redirect.github.com/axios/axios/pull/10898">#10898</a>)</li> <li>Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4414924447" data-permission-text="Title is private" data-url="axios/axios#10875" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10875/hovercard" href="https://redirect.github.com/axios/axios/pull/10875">#10875</a>)</li> <li>Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4340876537" data-permission-text="Title is private" data-url="axios/axios#10812" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10812/hovercard" href="https://redirect.github.com/axios/axios/pull/10812">#10812</a>)</li> <li>Bundler Compatibility: Converted <code>resolveConfig</code> from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4444501376" data-permission-text="Title is private" data-url="axios/axios#10891" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10891/hovercard" href="https://redirect.github.com/axios/axios/pull/10891">#10891</a>)</li> <li>Types: Corrected <code>AxiosHeaders.toJSON()</code> return types and updated CommonJS <code>isCancel</code> typings to narrow to <code>CanceledError<T></code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4541388760" data-permission-text="Title is private" data-url="axios/axios#10956" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10956/hovercard" href="https://redirect.github.com/axios/axios/pull/10956">#10956</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4534902166" data-permission-text="Title is private" data-url="axios/axios#10952" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10952/hovercard" href="https://redirect.github.com/axios/axios/pull/10952">#10952</a>)</li> <li>Build Tooling: Avoided emitting a null <code>Authorization</code> header from the GitHub build helper when <code>GITHUB_TOKEN</code> is unset. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497546091" data-permission-text="Title is private" data-url="axios/axios#10931" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10931/hovercard" href="https://redirect.github.com/axios/axios/pull/10931">#10931</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li>HTTP/2 Internals: Extracted <code>Http2Sessions</code> into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4395016914" data-permission-text="Title is private" data-url="axios/axios#10861" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10861/hovercard" href="https://redirect.github.com/axios/axios/pull/10861">#10861</a>)</li> <li>Package Publishing: Reduced published package size by switching to a <code>files</code> allowlist and dropping unneeded unminified bundle source maps. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506840788" data-permission-text="Title is private" data-url="axios/axios#10939" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10939/hovercard" href="https://redirect.github.com/axios/axios/pull/10939">#10939</a>)</li> <li>CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471484133" data-permission-text="Title is private" data-url="axios/axios#10907" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10907/hovercard" href="https://redirect.github.com/axios/axios/pull/10907">#10907</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4477353252" data-permission-text="Title is private" data-url="axios/axios#10911" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10911/hovercard" href="https://redirect.github.com/axios/axios/pull/10911">#10911</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479841599" data-permission-text="Title is private" data-url="axios/axios#10916" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10916/hovercard" href="https://redirect.github.com/axios/axios/pull/10916">#10916</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496500463" data-permission-text="Title is private" data-url="axios/axios#10927" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10927/hovercard" href="https://redirect.github.com/axios/axios/pull/10927">#10927</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506636815" data-permission-text="Title is private" data-url="axios/axios#10935" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10935/hovercard" href="https://redirect.github.com/axios/axios/pull/10935">#10935</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4564803325" data-permission-text="Title is private" data-url="axios/axios#10983" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10983/hovercard" href="https://redirect.github.com/axios/axios/pull/10983">#10983</a>)</li> <li>Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496362243" data-permission-text="Title is private" data-url="axios/axios#10925" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10925/hovercard" href="https://redirect.github.com/axios/axios/pull/10925">#10925</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479754974" data-permission-text="Title is private" data-url="axios/axios#10914" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10914/hovercard" href="https://redirect.github.com/axios/axios/pull/10914">#10914</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4542923609" data-permission-text="Title is private" data-url="axios/axios#10958" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10958/hovercard" href="https://redirect.github.com/axios/axios/pull/10958">#10958</a>)</li> <li>Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439857559" data-permission-text="Title is private" data-url="axios/axios#10890" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10890/hovercard" href="https://redirect.github.com/axios/axios/pull/10890">#10890</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439812615" data-permission-text="Title is private" data-url="axios/axios#10889" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10889/hovercard" href="https://redirect.github.com/axios/axios/pull/10889">#10889</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4488493808" data-permission-text="Title is private" data-url="axios/axios#10921" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10921/hovercard" href="https://redirect.github.com/axios/axios/pull/10921">#10921</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4521919780" data-permission-text="Title is private" data-url="axios/axios#10945" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10945/hovercard" href="https://redirect.github.com/axios/axios/pull/10945">#10945</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471392208" data-permission-text="Title is private" data-url="axios/axios#10905" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10905/hovercard" href="https://redirect.github.com/axios/axios/pull/10905">#10905</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4504485021" data-permission-text="Title is private" data-url="axios/axios#10933" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10933/hovercard" href="https://redirect.github.com/axios/axios/pull/10933">#10933</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479794362" data-permission-text="Title is private" data-url="axios/axios#10915" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10915/hovercard" href="https://redirect.github.com/axios/axios/pull/10915">#10915</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439585604" data-permission-text="Title is private" data-url="axios/axios#10887" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10887/hovercard" href="https://redirect.github.com/axios/axios/pull/10887">#10887</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4539242124" data-permission-text="Title is private" data-url="axios/axios#10955" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10955/hovercard" href="https://redirect.github.com/axios/axios/pull/10955">#10955</a>)</li> <li>Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, <code>fs-extra</code>, <code>qs</code>, docs dependencies, and GitHub Actions dependencies including <code>actions/dependency-review-action</code> and <code>zizmorcore/zizmor-action</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4413298372" data-permission-text="Title is private" data-url="axios/axios#10871" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10871/hovercard" href="https://redirect.github.com/axios/axios/pull/10871">#10871</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4430775028" data-permission-text="Title is private" data-url="axios/axios#10879" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10879/hovercard" href="https://redirect.github.com/axios/axios/pull/10879">#10879</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4481451976" data-permission-text="Title is private" data-url="axios/axios#10918" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10918/hovercard" href="https://redirect.github.com/axios/axios/pull/10918">#10918</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4481452562" data-permission-text="Title is private" data-url="axios/axios#10919" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10919/hovercard" href="https://redirect.github.com/axios/axios/pull/10919">#10919</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4504986865" data-permission-text="Title is private" data-url="axios/axios#10934" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10934/hovercard" href="https://redirect.github.com/axios/axios/pull/10934">#10934</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4526297030" data-permission-text="Title is private" data-url="axios/axios#10947" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10947/hovercard" href="https://redirect.github.com/axios/axios/pull/10947">#10947</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4537480721" data-permission-text="Title is private" data-url="axios/axios#10954" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10954/hovercard" href="https://redirect.github.com/axios/axios/pull/10954">#10954</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4549771364" data-permission-text="Title is private" data-url="axios/axios#10960" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10960/hovercard" href="https://redirect.github.com/axios/axios/pull/10960">#10960</a>)</li> </ul> <h2>🌟 New Contributors</h2> We are thrilled to welcome our new contributors. Thank you for helping improve axios: <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BasixKOR/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/BasixKOR">@ BasixKOR</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2873194565" data-permission-text="Title is private" data-url="axios/axios#6792" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/6792/hovercard" href="https://redirect.github.com/axios/axios/pull/6792">#6792</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/carladams1299-lab/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/carladams1299-lab">@ carladams1299-lab</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4395016914" data-permission-text="Title is private" data-url="axios/axios#10861" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10861/hovercard" href="https://redirect.github.com/axios/axios/pull/10861">#10861</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/LaplaceYoung/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/LaplaceYoung">@ LaplaceYoung</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4340876537" data-permission-text="Title is private" data-url="axios/axios#10812" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10812/hovercard" href="https://redirect.github.com/axios/axios/pull/10812">#10812</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/JamieMagee/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/JamieMagee">@ JamieMagee</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506840788" data-permission-text="Title is private" data-url="axios/axios#10939" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10939/hovercard" href="https://redirect.github.com/axios/axios/pull/10939">#10939</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/RonGamzu/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/RonGamzu">@ RonGamzu</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471392208" data-permission-text="Title is private" data-url="axios/axios#10905" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10905/hovercard" href="https://redirect.github.com/axios/axios/pull/10905">#10905</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sapirbaruch/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/sapirbaruch">@ sapirbaruch</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4444501376" data-permission-text="Title is private" data-url="axios/axios#10891" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10891/hovercard" href="https://redirect.github.com/axios/axios/pull/10891">#10891</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/nezukoagent/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/nezukoagent">@ nezukoagent</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4463370380" data-permission-text="Title is private" data-url="axios/axios#10901" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10901/hovercard" href="https://redirect.github.com/axios/axios/pull/10901">#10901</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/devareddy05/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/devareddy05">@ devareddy05</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497340497" data-permission-text="Title is private" data-url="axios/axios#10929" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10929/hovercard" href="https://redirect.github.com/axios/axios/pull/10929">#10929</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Mohammad-Faiz-Cloud-Engineer/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Mohammad-Faiz-Cloud-Engineer">@ Mohammad-Faiz-Cloud-Engineer</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4490479466" data-permission-text="Title is private" data-url="axios/axios#10922" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10922/hovercard" href="https://redirect.github.com/axios/axios/pull/10922">#10922</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/azandabot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/azandabot">@ azandabot</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497546091" data-permission-text="Title is private" data-url="axios/axios#10931" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10931/hovercard" href="https://redirect.github.com/axios/axios/pull/10931">#10931</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/niksy/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/niksy">@ niksy</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4452495512" data-permission-text="Title is private" data-url="axios/axios#10896" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10896/hovercard" href="https://redirect.github.com/axios/axios/pull/10896">#10896</a>)</li> </ul> <a href="https://redirect.github.com/axios/axios/compare/v1.16.1...v1.17.0">Full Changelog</a> </li> <li> 1.16.1 - <a href="https://redirect.github.com/axios/axios/releases/tag/v1.16.1">2026-05-13</a><h2>v1.16.1 — May 13, 2026</h2> This release ships a defence-in-depth fix for prototype pollution in <code>formDataToJSON</code>, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements. <h2>🔒 Security Fixes</h2> <ul> <li>Prototype Pollution Defence-in-Depth: Hardened <code>formDataToJSON</code> against already-polluted <code>Object.prototype</code> by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3959581677" data-permission-text="Title is private" data-url="axios/axios#7413" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/7413/hovercard" href="https://redirect.github.com/axios/axios/pull/7413">#7413</a>)</li> <li>Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392783718" data-permission-text="Title is private" data-url="axios/axios#10858" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10858/hovercard" href="https://redirect.github.com/axios/axios/pull/10858">#10858</a>)</li> <li>CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4431484006" data-permission-text="Title is private" data-url="axios/axios#10882" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10882/hovercard" href="https://redirect.github.com/axios/axios/pull/10882">#10882</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Data URI Parsing: Updated the <code>fromDataURI</code> regex to match RFC 2397 more strictly, fixing edge cases in <code>data:</code> URL handling. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4356424237" data-permission-text="Title is private" data-url="axios/axios#10829" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10829/hovercard" href="https://redirect.github.com/axios/axios/pull/10829">#10829</a>)</li> <li>Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4388506485" data-permission-text="Title is private" data-url="axios/axios#10850" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10850/hovercard" href="https://redirect.github.com/axios/axios/pull/10850">#10850</a>)</li> <li>XHR Upload Progress: Guarded against malformed <code>ProgressEvent</code> payloads emitted by some environments during XHR upload, preventing crashes when <code>loaded</code> / <code>total</code> are missing or invalid. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4409815240" data-permission-text="Title is private" data-url="axios/axios#10868" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10868/hovercard" href="https://redirect.github.com/axios/axios/pull/10868">#10868</a>)</li> <li>Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4400660060" data-permission-text="Title is private" data-url="axios/axios#10864" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10864/hovercard" href="https://redirect.github.com/axios/axios/pull/10864">#10864</a>)</li> <li>Type Definitions: Made <code>parseReviver</code> <code>context.source</code> optional in the type definitions to align with the ES2023 specification. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4370232960" data-permission-text="Title is private" data-url="axios/axios#10837" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10837/hovercard" href="https://redirect.github.com/axios/axios/pull/10837">#10837</a>)</li> <li>URL Object Support Reverted: Reverted the change that allowed passing a <code>URL</code> object as <code>config.url</code> (originally <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4403806527" data-permission-text="Title is private" data-url="axios/axios#10866" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10866/hovercard" href="https://redirect.github.com/axios/axios/pull/10866">#10866</a>) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4414921751" data-permission-text="Title is private" data-url="axios/axios#10874" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10874/hovercard" href="https://redirect.github.com/axios/axios/pull/10874">#10874</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li>Cycle Detection Refactor: Replaced the array-based cycle tracker in <code>toJSONObject</code> with a <code>WeakSet</code>, improving performance and memory behaviour on large nested structures. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4361368446" data-permission-text="Title is private" data-url="axios/axios#10832" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10832/hovercard" href="https://redirect.github.com/axios/axios/pull/10832">#10832</a>)</li> <li>composeSignals Cleanup: Refactored <code>composeSignals</code> to use a clearer early-return structure, simplifying the cancellation/abort composition path. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4380190238" data-permission-text="Title is private" data-url="axios/axios#10844" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10844/hovercard" href="https://redirect.github.com/axios/axios/pull/10844">#10844</a>)</li> <li>AI Readiness & Repo Docs: Added <code>AGENTS.md</code> and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369274702" data-permission-text="Title is private" data-url="axios/axios#10835" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10835/hovercard" href="https://redirect.github.com/axios/axios/pull/10835">#10835</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4378451451" data-permission-text="Title is private" data-url="axios/axios#10841" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10841/hovercard" href="https://redirect.github.com/axios/axios/pull/10841">#10841</a>)</li> <li>Docs Improvements: Clarified the GET request example, fixed the interceptor <code>eject</code> example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369287222" data-permission-text="Title is private" data-url="axios/axios#10836" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10836/hovercard" href="https://redirect.github.com/axios/axios/pull/10836">#10836</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4390162698" data-permission-text="Title is private" data-url="axios/axios#10853" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10853/hovercard" href="https://redirect.github.com/axios/axios/pull/10853">#10853</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392363280" data-permission-text="Title is private" data-url="axios/axios#10856" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10856/hovercard" href="https://redirect.github.com/axios/axios/pull/10856">#10856</a>)</li> <li>Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4378946632" data-permission-text="Title is private" data-url="axios/axios#10843" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10843/hovercard" href="https://redirect.github.com/axios/axios/pull/10843">#10843</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4393416912" data-permission-text="Title is private" data-url="axios/axios#10859" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10859/hovercard" href="https://redirect.github.com/axios/axios/pull/10859">#10859</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4412918174" data-permission-text="Title is private" data-url="axios/axios#10869" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10869/hovercard" href="https://redirect.github.com/axios/axios/pull/10869">#10869</a>)</li> <li>Dependencies: Bumped <code>@ commitlint/cli</code> from 20.5.0 to 20.5.2. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4383276255" data-permission-text="Title is private" data-url="axios/axios#10846" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10846/hovercard" href="https://redirect.github.com/axios/axios/pull/10846">#10846</a>)</li> </ul> <h2>🌟 New Contributors</h2> We are thrilled to welcome our new contributors. Thank you for helping improve axios: <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/hpinmetaverse/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/hpinmetaverse">@ hpinmetaverse</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369287222" data-permission-text="Title is private" data-url="axios/axios#10836" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10836/hovercard" href="https://redirect.github.com/axios/axios/pull/10836">#10836</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tommyhgunz14/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/tommyhgunz14">@ tommyhgunz14</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3959581677" data-permission-text="Title is private" data-url="axios/axios#7413" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/7413/hovercard" href="https://redirect.github.com/axios/axios/pull/7413">#7413</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/abhu85/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/abhu85">@ abhu85</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4356424237" data-permission-text="Title is private" data-url="axios/axios#10829" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10829/hovercard" href="https://redirect.github.com/axios/axios/pull/10829">#10829</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/divyanshuraj1095/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/divyanshuraj1095">@ divyanshuraj1095</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4390162698" data-permission-text="Title is private" data-url="axios/axios#10853" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10853/hovercard" href="https://redirect.github.com/axios/axios/pull/10853">#10853</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sagodi97/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/sagodi97">@ sagodi97</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392363280" data-permission-text="Title is private" data-url="axios/axios#10856" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10856/hovercard" href="https://redirect.github.com/axios/axios/pull/10856">#10856</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rkdfx/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/rkdfx">@ rkdfx</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4409815240" data-permission-text="Title is private" data-url="axios/axios#10868" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10868/hovercard" href="https://redirect.github.com/axios/axios/pull/10868">#10868</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Liuwei1125/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Liuwei1125">@ Liuwei1125</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4403806527" data-permission-text="Title is private" data-url="axios/axios#10866" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10866/hovercard" href="https://redirect.github.com/axios/axios/pull/10866">#10866</a>)</li> </ul> <a href="https://redirect.github.com/axios/axios/compare/v1.16.0...v1.16.1">Full Changelog</a> </li> </ul> from <a href="https://redirect.github.com/axios/axios/releases">axios GitHub release notes</a> </details> </details> --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._ **For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJiZjMyYzAwMC1iZGM2LTQyMzktYjg1Mi0wMzRhOGNhYTIzZDUiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImJmMzJjMDAwLWJkYzYtNDIzOS1iODUyLTAzNGE4Y2FhMjNkNSJ9fQ==" width="0" height="0"/> > - 🧐 [View latest project report](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template) > - 🛠 [Adjust upgrade PR settings](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2/settings/integration?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2/settings/integration?pkg=axios&utm_source=github&utm_medium=referral&page=upgrade-pr#auto-dep-upgrades) [//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"axios","from":"1.16.1","to":"1.17.0"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"bf32c000-bdc6-4239-b852-034a8caa23d5","prPublicId":"bf32c000-bdc6-4239-b852-034a8caa23d5","packageManager":"npm","priorityScoreList":[],"projectPublicId":"58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2","projectUrl":"https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-06-03T06:58:28.145Z"},"vulns":[]}' Co-authored-by: snyk-bot <[email protected]>

fix: preserve Unicode headers for request interceptors

591b07b

cyphercodes requested a review from jasonsaayman as a code owner May 6, 2026 03:21

cubic-dev-ai Bot reviewed May 6, 2026

View reviewed changes

Comment thread lib/core/AxiosHeaders.js Outdated

fix: sanitize adapter-bound header values

1a8fa4e

cubic-dev-ai Bot reviewed May 6, 2026

View reviewed changes

jasonsaayman assigned cyphercodes May 6, 2026

jasonsaayman added priority::medium labels May 6, 2026

jasonsaayman requested changes May 6, 2026

View reviewed changes

jasonsaayman added the status::changes-requested A reviewer requested changes to the PR label May 6, 2026

perf: use regex header value sanitization

da70e69

jasonsaayman added 3 commits May 6, 2026 18:52

Merge branch 'v1.x' into fix/unicode-header-interceptor-sanitization

df8dda9

chore: added tests to cover regression cases

603bf6a

docs: update with latest changes

e70b317

jasonsaayman approved these changes May 6, 2026

View reviewed changes

jasonsaayman merged commit cabead5 into axios:v1.x May 6, 2026
23 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: preserve Unicode headers for request interceptors#10850

fix: preserve Unicode headers for request interceptors#10850
jasonsaayman merged 6 commits into
axios:v1.xfrom
cyphercodes:fix/unicode-header-interceptor-sanitization

cyphercodes commented May 6, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot May 6, 2026

Uh oh!

jasonsaayman left a comment •

edited

Loading

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

cyphercodes commented May 6, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked issue

Changes

Checklist

Summary by cubic

Description

Docs

Testing

Semantic version impact

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

jasonsaayman left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cyphercodes commented May 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cyphercodes commented May 6, 2026 •

edited by cubic-dev-ai Bot

Loading

jasonsaayman left a comment •

edited

Loading