Summary

Reject malformed http: and https: URLs that omit // before adapter URL normalisation, returning AxiosError with ERR_INVALID_URL instead of silently normalising invalid input.

This also tightens related security coverage around polluted inherited config values, upload/content length limits, data URL size estimation, FormData recursion depth, and local proxy bypass matching.

Linked issue

Closes #7315

Changes

• Reject malformed HTTP(S) URLs such as https:example.com and http:/example.com across core URL building and adapters.
• Ignore inherited prototype-polluted config/header/auth/params values in affected request paths.
• Enforce upload and content length limits more consistently in fetch and HTTP adapters.
• Add recursion depth protection for formDataToJSON.
• Treat unspecified local addresses like 0.0.0.0 and IPv6 :: as local for NO_PROXY matching.
• Add focused regression coverage and pre-release changelog/docs tracking.

Checklist

• Tests added or updated
• Docs/types updated if public API changed (index.d.ts and index.d.cts) - N/A, no public API or type change
• No breaking changes

Summary by cubic

Reject malformed HTTP(S) URLs that omit “//” and harden stream/proxy safety. Size limits are now enforced consistently across fetch, Node HTTP/HTTPS/HTTP2, and custom fetch, and header/config reads ignore prototype pollution.

Description

• Summary of changes
  • Reject malformed http:/https: URLs before adapter normalization; throw AxiosError ERR_INVALID_URL and preserve config.
  • Read nested config safely via utils.getSafeProp (auth, headers, params, serializer, proxy, method, agents, limits, timeouts, decompress); ignore values injected on Object.prototype.
  • Ignore inherited Symbol.iterator for header sources; only own iterators are used for request and response headers.
  • Enforce maxBodyLength on streamed uploads in fetch, native HTTP/HTTPS, HTTP/2, and custom fetch; never trust caller-declared Content-Length. If the Request impl doesn’t support stream bodies, throw ERR_NOT_SUPPORT instead of forcing a stream.
  • Enforce maxContentLength on streamed responses with declared-length pre-checks; accept plain-object response headers via AxiosHeaders.
  • Align FormData recursion limits using DEFAULT_FORM_DATA_MAX_DEPTH (100) and guard both {} metatokens and formDataToJSON path parsing; throw ERR_FORM_DATA_DEPTH_EXCEEDED.
  • Treat 0.0.0.0 and IPv6 :: (including compressed/all-zero forms) as local for NO_PROXY.
  • Compute exact decoded size for percent-encoded data: URLs.
  • Helpers: bodyless method helpers ignore inherited data; getUri ignores inherited serializer options.
• Reasoning
  • Block silent URL normalization and prototype pollution in untrusted inputs.
  • Apply consistent, stream-aware limits across transports to prevent DoS/overflows.
• Additional context
  • Closes Normalization of url cause an ssrf security bypass #7315.
  • No public API or types changed; behavior tightens invalid/edge cases.

Docs

Please update /docs/:

• Note that malformed http:/https: URLs missing // now throw ERR_INVALID_URL.
• Document the shared FormData depth guard (DEFAULT_FORM_DATA_MAX_DEPTH = 100) and ERR_FORM_DATA_DEPTH_EXCEEDED.
• Mention stricter local address handling for NO_PROXY (0.0.0.0, ::) and consistent stream size enforcement; fetch throws ERR_NOT_SUPPORT when its Request does not support stream bodies.

Testing

• Added/updated tests:
  • Malformed URL rejection in fetch, Node HTTP/HTTP2, and XHR; config preserved.
  • Pollution-safe reads for nested options; bodyless helpers ignore inherited data; getUri ignores inherited serializer options.
  • Ignore inherited Symbol.iterator for request/response headers; iterable sources must have own iterators.
  • maxBodyLength on streamed uploads across fetch, native HTTP/HTTPS, HTTP/2, and custom fetch; declared Content-Length cannot bypass limits; throw ERR_NOT_SUPPORT when Request lacks stream support.
  • maxContentLength on streamed responses with declared-length pre-checks; plain-object headers supported via AxiosHeaders.
  • FormData depth guard for {} metatokens and formDataToJSON parsing; throws ERR_FORM_DATA_DEPTH_EXCEEDED.
  • Exact decoded size for percent-encoded data: URLs.
  • NO_PROXY matching for 0.0.0.0 and IPv6 :: (including compressed forms and ports).
• Coverage spans unit, browser, and adapter tests; no additional tests needed.

Semantic version impact

Patch: bug fixes and security hardening. Invalid inputs that were previously normalized now throw ERR_INVALID_URL; no API changes.

^{Written for commit d454282. Summary will update on new commits.}