Vulnerability · Published Jan 7, 2026 · Assigned by GitHub_M

CVE-2026-21697axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak

High 8.2

In plain English

A high-severity race condition in axios4go from rezmoss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

Affected products (as reported)

Vendor	Product	Versions
rezmoss	axios4go	< 0.6.4

Weakness: CWE-362 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/rezmoss/axios4go/security/advisories/GHSA-cmj9-27wj-7x47 x_refsource_CONFIRM
https://github.com/rezmoss/axios4go/commit/b651604c64e66a115ab90cdab358b0181d74a842 x_refsource_MISC
https://github.com/rezmoss/axios4go/releases/tag/v0.6.4 x_refsource_MISC