CVE-2026-21697CWE-362

axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak

High · published January 7, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00408 · 34.0th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-07T22:29Z
EPSS history
Timeline
  • 07 JAN 22:29Z
    axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak
    cvelistv5