axios@1.12.2 vulnerability (CVE-2026-25639)

[felipeloge]

Describe the bug

There is vulnerability in axios@1.12.3 used by @module-federation package:
https://nvd.nist.gov/vuln/detail/CVE-2026-25639

Proposed fix:
Upgrade to version 1.13.5.

---

NOTE: there is already a PR open for that:
#4406

Reproduction

https://github.com/module-federation/core/blob/main/package.json#L158

Used Package Manager

npm

System Info

n/a

Validations

• Read the docs.
• Read the common issues list.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Module federation issue and not a framework-specific issue.
• The provided reproduction is a minimal reproducible example of the bug.

[2heal1]

fixed in 2.2.0 #4541

[felipeloge]

Great! I'll close the issue. Thanks @2heal1