High 8.1Published Jan 7, 2026

CVE-2026-21697axios4go is a Go HTTP client library.

Updated under an hour ago (2026-10-19 13:40 UTC)

Does this affect you?

It affects rezmoss axios4go. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rezmoss axios4go

Exploited in the last 30 days

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

CVSS: 8.1 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

rezmoss axios4go rezmoss:axios4go	before 0.6.4	NVD

References

https://github.com/rezmoss/axios4go/commit/b651604c64e66a115ab90cdab358b0181d74a842patch
https://github.com/rezmoss/axios4go/releases/tag/v0.6.4product
https://github.com/rezmoss/axios4go/security/advisories/GHSA-cmj9-27wj-7x47mitigation, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.