CVE-2026-21697: axios4go Race Condition Vulnerability

CVE-2026-21697 Overview

A race condition vulnerability exists in axios4go, a Go HTTP client library. Prior to version 0.6.4, the global defaultClient is mutated during request execution without proper synchronization, directly modifying the shared http.Client's Transport, Timeout, and CheckRedirect properties. This Time-of-Check Time-of-Use (TOCTOU) vulnerability can lead to data integrity issues in applications making concurrent HTTP requests.

Critical Impact
Concurrent requests in axios4go applications can result in request routing through unintended proxy configurations, potentially exposing authentication credentials, tokens, and API keys to unauthorized destinations.

Affected Products

axios4go versions prior to 0.6.4
Applications using axios4go with concurrent requests (multiple goroutines)
Applications using async methods (GetAsync, PostAsync, etc.) with different proxy configurations

Discovery Timeline

2026-01-07 - CVE-2026-21697 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21697

Vulnerability Analysis

This vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). The core issue stems from axios4go's architecture where the global HTTP client configuration is shared across all requests without thread-safe access controls.

When multiple goroutines execute concurrent HTTP requests, each may attempt to modify the shared http.Client properties simultaneously. Since Go's http.Client struct is not inherently thread-safe when its fields are being modified, this creates a classic race condition scenario. The lack of mutex locks or other synchronization primitives means that one request's configuration can inadvertently affect another request executing in parallel.

Applications handling sensitive data are particularly at risk, as authentication credentials or API tokens intended for one endpoint could be routed through a proxy configured by a different concurrent request.

Root Cause

The root cause is the absence of synchronization mechanisms protecting the global defaultClient instance. The library directly mutates the shared http.Client's Transport, Timeout, and CheckRedirect properties during request execution, creating a TOCTOU race condition where the configuration checked at request initiation may differ from the configuration used at request execution.

Attack Vector

The vulnerability is exploitable over the network when an application uses axios4go to make concurrent HTTP requests with varying configurations. An attacker could potentially exploit timing windows to manipulate which proxy or configuration is used for sensitive requests.

The attack scenario involves:

An application makes concurrent requests using axios4go's async methods
Different requests are configured with different proxy settings or timeouts
Due to the race condition, one request may inherit the configuration intended for another
Sensitive data such as authentication tokens could be routed through unintended network paths

This creates opportunities for credential interception when requests are inadvertently routed through attacker-controlled proxies, or integrity violations when timeout and redirect settings are unexpectedly modified mid-request.

Detection Methods for CVE-2026-21697

Indicators of Compromise

Unexpected network traffic routing through unintended proxy servers in application logs
Intermittent authentication failures or token validation errors in applications using axios4go
Inconsistent timeout behavior observed in concurrent HTTP request patterns
Log entries showing requests reaching incorrect endpoints or proxy destinations

Detection Strategies

Review application dependencies to identify axios4go versions prior to 0.6.4
Implement race condition detection using Go's built-in race detector (go build -race)
Monitor application logs for intermittent connectivity issues that may indicate configuration race conditions
Audit code for usage of async methods (GetAsync, PostAsync) with differing configurations

Monitoring Recommendations

Enable detailed HTTP request logging to track proxy routing and timeout configurations
Implement network traffic analysis to detect requests being routed to unexpected destinations
Set up alerting for authentication failures that correlate with high-concurrency request periods
Monitor for unexplained credential exposure incidents in applications using axios4go

How to Mitigate CVE-2026-21697

Immediate Actions Required

Upgrade axios4go to version 0.6.4 or later immediately
Audit applications for concurrent usage patterns with different proxy configurations
Review any credentials or tokens that may have been exposed through misconfigured routing
Consider rotating API keys and tokens for applications that were using vulnerable versions

Patch Information

The vulnerability has been addressed in axios4go version 0.6.4. The fix implements proper synchronization for the shared HTTP client configuration, preventing concurrent modification of the Transport, Timeout, and CheckRedirect properties.

Patch details are available in the GitHub commit and the v0.6.4 release. Additional information can be found in the GitHub Security Advisory GHSA-cmj9-27wj-7x47.

Workarounds

Avoid using async methods (GetAsync, PostAsync) with different proxy configurations until patched
Implement application-level synchronization when making concurrent requests with varying configurations
Create separate HTTP client instances for requests requiring different proxy or timeout settings
Limit concurrent request execution to serialize configuration-sensitive operations

bash

# Update axios4go to the patched version
go get github.com/rezmoss/axios4go@v0.6.4

# Verify the installed version
go list -m github.com/rezmoss/axios4go

# Run your application with race detection enabled to identify issues
go build -race -o myapp && ./myapp