v1.16.1 — May 13, 2026
This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.
🔒 Security Fixes
- Prototype Pollution Defence-in-Depth: Hardened
formDataToJSONagainst already-pollutedObject.prototypeby walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413) - Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
- CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)
🐛 Bug Fixes
- Data URI Parsing: Updated the
fromDataURIregex to match RFC 2397 more strictly, fixing edge cases indata:URL handling. (#10829) - Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
- XHR Upload Progress: Guarded against malformed
ProgressEventpayloads emitted by some environments during XHR upload, preventing crashes whenloaded/totalare missing or invalid. (#10868) - Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
- Type Definitions: Made
parseRevivercontext.sourceoptional in the type definitions to align with the ES2023 specification. (#10837) - URL Object Support Reverted: Reverted the change that allowed passing a
URLobject asconfig.url(originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)
🔧 Maintenance & Chores
- Cycle Detection Refactor: Replaced the array-based cycle tracker in
toJSONObjectwith aWeakSet, improving performance and memory behaviour on large nested structures. (#10832) - composeSignals Cleanup: Refactored
composeSignalsto use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844) - AI Readiness & Repo Docs: Added
AGENTS.mdand related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841) - Docs Improvements: Clarified the GET request example, fixed the interceptor
ejectexample to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856) - Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
- Dependencies: Bumped
@commitlint/clifrom 20.5.0 to 20.5.2. (#10846)
🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios: