CVE-2026-25639 is a denial of service vulnerability in the Axios npm package, specifically in the mergeConfig function. When this function processes configuration objects that include __proto__ as an own property, it crashes with a TypeError. An attacker can exploit this by providing a malicious configuration object, for example via JSON.parse(), leading to complete denial of service. This vulnerability affects several Red Hat products that include Axios, such as Red Hat Migration Toolkit for Containers and Red Hat Satellite. Red Hat has analyzed the issue and currently does not provide a mitigation that meets their criteria for deployment and stability. The vulnerability is tracked under Red Hat advisory RHSA-2026:25041 and is associated with multiple CVEs including CVE-2026-25639 and CVE-2026-40175.

The vulnerability allows an attacker to cause a complete denial of service by crashing the mergeConfig function in Axios when processing specially crafted configuration objects. This impacts availability of affected Red Hat products that use Axios internally. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported at this time.

Red Hat currently does not provide an official mitigation for this vulnerability that meets their criteria for ease of use, applicability, and stability. Users are advised to apply all previously released errata relevant to their systems. Monitoring Red Hat advisories for updates or patches is recommended. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for guidance. Upgrading to a future fixed version when available is recommended once Red Hat releases a patch.