axios/axios
Promise based HTTP client for the browser and node.js
How axios is put together
axios is a promise-based HTTP client library for browsers and Node.js, written in JavaScript (ES modules) with TypeScript type definitions. Its architecture is layered: lib/axios.js creates the default instance; lib/core contains the Axios request class, header handling, interceptor manager, config merging, and dispatch pipeline; lib/adapters provides pluggable transports (http for Node via follow-redirects/https-proxy-agent, xhr and fetch for browsers); lib/helpers implements URL building, form-data serialization, streaming, cookies, and progress utilities; lib/platform abstracts environment-specific classes (Buffer, FormData, Blob) between Node and browser builds. Data flows from user config through interceptors and request transformers into an adapter, then back through response transformers and settle logic to resolve/reject promises. Builds are bundled by Rollup into ESM, UMD, browser CJS, and Node CJS distributions.
Languages
Frameworks
Infrastructure
Major components
lib/core
Implements the Axios class, AxiosHeaders, AxiosError, interceptor manager, dispatchRequest, config merging, settle logic, and full-path building that drive the request/response lifecycle.
lib/adapters
Provides pluggable HTTP transports: http.js (Node http/https with proxy support), xhr.js (browser XMLHttpRequest), fetch.js, and adapters.js adapter resolution.
lib/helpers
Utility layer for URL construction, params serialization, form-data conversion/streaming, cookies, progress events, signals/composition, stream throttling, and header sanitization.
lib/platform
Abstracts platform-specific classes (Buffer, FormData, Blob, URLSearchParams) and utils so the same core code runs on Node and in browsers.
lib/cancel
Implements cancellation semantics: CancelToken, CanceledError, and isCancel.
lib/defaults
Holds default configuration (headers, transforms, adapter selection, timeouts) and transitional feature flags.
build tooling (rollup.config.js, gulpfile.js)
Produces four distribution bundles (ESM, UMD, browser CJS, Node CJS) with minification, Babel transpilation, and bundle-size reporting.
tests (vitest.config.js, tests/unit, tests/browser)
Runs unit tests under Node and cross-browser tests via Playwright-driven Vitest projects (chromium, firefox, webkit), plus CJS/ESM/Deno/Bun smoke tests.
A quiet week with just the release of version 1.20.0.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A quiet week with just the release of version 1.20.0.
Week of 2026-08-10
A batch of reliability fixes to error handling and progress reporting, plus routine dependency updates.
Week of 2026-08-03
A memory leak fix and new status code aliases headlined a busy week alongside docs improvements.
Week of 2026-07-27
Fixes for canceled browser requests and interceptor cleanup, plus documentation updates after the last release.
Week of 2026-07-20
Mostly maintenance work leading up to the 1.19.0 release.
Over the past five weeks, the axios project moved through a steady cycle of bug fixes and dependency upkeep, culminating in two releases: version 1.19.0 in late July and version 1.20.0 in mid-August. The fixes focused on making error handling more reliable across browsers and Node, patching a memory leak in the HTTP adapter, and cleaning up interceptor behavior. Documentation also got attention, including new sponsors and localized search on the docs site.
Week by week
2026-08-17A quiet week with just the release of version 1.20.0.latest1 change
Chore
Release 1.20.0
The team packaged up recent fixes into a new official release of the library.
2026-08-10A batch of reliability fixes to error handling and progress reporting, plus routine dependency updates.5 changes
Fix
Core method list and HTTP adapter errors fixed
Corrected how the library tracks its request methods and reports errors from Node-based requests, with new tests added to keep it honest.
Fix
Browser upload progress now completes fully
Upload/download progress events in browsers now fire their final update so users see 100% completion reliably.
Fix
Interceptors tolerate missing handlers
Request/response interceptors no longer crash when an entry is unexpectedly empty or removed.
Fix
Hardened runtime option handling
The library now safely handles unusual or malformed configuration options passed at runtime instead of failing unpredictably.
Chore
Dependency updates
Several internal tools and test dependencies were bumped to newer versions for security and maintenance.
2026-08-03A memory leak fix and new status code aliases headlined a busy week alongside docs improvements.5 changes
Fix
Memory leak fixed in Node requests
Fixed a leak where each network socket kept a reference to the original request, causing memory to build up over time.
Feature
New status code names added
Added modern standard aliases for the 'payload too large' (413) and 'unprocessable content' (422) HTTP statuses.
Docs
Localized search on documentation site
Visitors can now search the documentation in their own language.
Docs
New sponsor added
ScrapingBee was added as a project sponsor, with sponsor data refreshed throughout the site.
Chore
Dependency updates
Development tools, test packages, and GitHub workflow actions were updated to newer versions.
2026-07-27Fixes for canceled browser requests and interceptor cleanup, plus documentation updates after the last release.5 changes
Fix
Canceled page navigations handled cleanly
When a user navigates away mid-request in a browser, the request now fails with a clear 'aborted' error instead of hanging.
Fix
Interceptor cleanup improved
Removing interceptors now properly trims leftover empty entries from the end of the handler list.
Fix
Safer error messages
Error decoration no longer breaks when an error's stack trace isn't a normal text string.
Docs
README stream example fixed
Added a missing import line to a code example so it works when copied directly.
Docs
Release notes applied to docs
Documentation was updated to reflect the changes in version 1.19.0.
2026-07-20Mostly maintenance work leading up to the 1.19.0 release.3 changes
Chore
Release 1.19.0 prepared
The team staged a new official release of the library with accumulated fixes.
Chore
Docs site uses newer axios
The documentation website was updated to run on a more recent version of the library itself.
Chore
Dependency updates
Build tools like postcss and fast-uri, plus GitHub workflow actions, were bumped to newer versions.
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (3 advisories) across 666 scanned dependencies.
brace-expansion 5.0.7
2 advisories. Fixed in 5.0.8.
How it can be abusedAn attacker who can feed a maliciously crafted brace pattern into this library could make it expand into enormous amounts of data, exhausting memory and crashing the process. In a project like axios this package only shows up indirectly through development and test tooling, so it does not affect the library's runtime behavior or its end users.
- highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
nanoid 3.3.16
1 advisory. Fixed in 3.3.18.
How it can be abusedThis bug only matters if code calls nanoid's custom generator with a size of zero, which makes it spin forever and hang the program. An attacker could trigger that only if they can control that size value in your own code; axios itself does not use nanoid this way, so real users of this library are not meaningfully affected.
- highGHSA-2v37-7h3g-55p8nanoid: custom generators can loop indefinitely when size is zero
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required