PT-2026-2093 · Axios4Go · Axios4Go

Rezmoss · Published 2026-01-07 · Updated 2026-03-09 · CVE-2026-21697

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions axios4go versions prior to 0.6.4

Description axios4go is a Go HTTP client library affected by a race condition in its shared HTTP client configuration. The global defaultClient is modified during request execution without proper synchronization, altering the shared http.Client's Transport, Timeout, and CheckRedirect properties. Applications using axios4go with concurrent requests (multiple goroutines, GetAsync, PostAsync, etc.), different proxy configurations, or handling sensitive data like authentication credentials and API keys are potentially impacted. The vulnerability allows for potential proxy configuration leaks.

Recommendations Versions prior to 0.6.4 should be updated to version 0.6.4 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-21697

GHSA-CMJ9-27WJ-7X47

Affected Products

Axios4Go

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21697.json · Exploit
• https://github.com/rezmoss/axios4go/commit/b651604c64e66a115ab90cdab358b0181d74a842 · Patch
• https://github.com/rezmoss/axios4go/security/advisories/GHSA-cmj9-27wj-7x47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21697 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21697 · Vendor Advisory
• https://github.com/rezmoss/axios4go/releases/tag/v0.6.4 · Note
• https://t.me/CVEtracker/41656 · Telegram Post
• https://t.me/cveNotify/154790 · Telegram Post
• https://twitter.com/dailycve/status/2031040077200081040 · Twitter Post
• https://twitter.com/CVEnew/status/2009032505706565962 · Twitter Post
• https://t.me/cveNotify/148009 · Telegram Post