fix(http): accept path-only url when socketPath is set (#6611) by devareddy05 · Pull Request #10930 · axios/axios

devareddy05 · 2026-05-21T19:38:51Z

Summary

axios({ url: '/foo', socketPath: '/tmp/x.sock' }) worked in 1.7.3 and started throwing TypeError [ERR_INVALID_URL] in 1.7.4 when new URL(fullPath, ...) was added to the node dispatch path. new URL('/foo') rejects path-only URLs because no base is supplied.

This restores the 1.7.3 behaviour by supplying a synthetic http://localhost base only when config.socketPath is set. Non-socket requests are untouched; absolute URLs continue to ignore the base per the URL spec, so this is a no-op for those cases.

Follows @jasonsaayman's guidance on the earlier attempt (#6623): "detect config.socketPath and synthesise a base (http://localhost) … with a test."

Linked issue

Closes #6611

Changes

lib/adapters/http.js: pick 'http://localhost' as the new URL() base when config.socketPath is set; keep platform.origin / undefined for all other cases.
tests/unit/adapters/http.test.js: regression test in the existing socketPath security describe block — axios.get('/echo?q=1', { socketPath }) reaches the Unix server with req.url === '/echo?q=1'. Verified the test fails on v1.x (same Invalid URL error from the issue's stack trace) and passes with this patch.
PRE_RELEASE_CHANGELOG.md: bug-fix entry under Unreleased.

Checklist

Tests added or updated (or N/A with reason)
Docs / types updated if public API changed (index.d.ts and index.d.cts) — N/A, no public API change
No breaking changes (or called out explicitly above)

_{AI-assisted (Claude Opus 4.7). Commit subject is one line per author preference; happy to amend in an Assisted-by: trailer if reviewers prefer.}

Summary by cubic

Restores support for path-only URLs like /foo when socketPath is set in Node, and ignores prototype-polluted socketPath values. Only socket requests get a synthetic http://localhost base; all other URLs are unchanged.

Description

Summary of changes
- lib/adapters/http.js: read socketPath via own('socketPath'); if set, use http://localhost as the new URL() base; otherwise keep existing base logic.
- Tests: add regression tests for path-only URL over a Unix socket and with allowedSocketPaths, plus a security test that ignores prototype-polluted socketPath.
- Changelog: add Bug Fix entry.
Reasoning
- new URL('/foo') needs a base. Supplying one only for real socket requests restores 1.7.3 behavior and prevents prototype pollution.
Additional context
- Regression introduced in 1.7.4; absolute URLs and non-socket requests are unaffected.

Docs

Add a note in /docs/ (Node HTTP adapter / Unix sockets) that:

Path-only URLs are supported when socketPath is set.
Only an own socketPath is honored for security.

Testing

Added unit tests for:
- Path-only URL with socketPath.
- Path-only URL with allowedSocketPaths.
- Ignoring prototype-polluted socketPath (asserts ERR_INVALID_URL and zero requests).
No further tests needed.

Semantic version impact

Patch.

^{Written for commit 02d8f0b. Summary will update on new commits.}

cubic-dev-ai

No issues found across 3 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

jasonsaayman

Mostly looking good, let's just fix the potential regression and add the additional test.

…pollution (axios#6611)

…ath-only-url # Conflicts: # PRE_RELEASE_CHANGELOG.md # lib/adapters/http.js

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [axios](https://axios-http.com) ([source](https://github.com/axios/axios)) | [`1.18.0` → `1.18.1`](https://renovatebot.com/diffs/npm/axios/1.18.0/1.18.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/axios/1.18.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/axios/1.18.0/1.18.1?slim=true) | --- ### Release Notes <details> <summary>axios/axios (axios)</summary> ### [`v1.18.1`](https://github.com/axios/axios/releases/tag/v1.18.1) [Compare Source](axios/axios@v1.18.0...v1.18.1) #### v1.18.1 — June 21, 2026 This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance. #### 🐛 Bug Fixes - AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. ([#10913](axios/axios#10913)) - Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. ([#10917](axios/axios#10917), [#10930](axios/axios#10930), [#10942](axios/axios#10942), [#10993](axios/axios#10993)) - Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. ([#10959](axios/axios#10959), [#11021](axios/axios#11021)) - AxiosURLSearchParams: Switched the encoder callback to an arrow function so `encoder.call(this)` receives the `AxiosURLSearchParams` instance correctly. ([#11019](axios/axios#11019)) #### 🔧 Maintenance & Chores - Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific ([#11007](axios/axios#11007), [#11010](axios/axios#11010), [#11023](axios/axios#11023), [#11025](axios/axios#11025)) - Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. ([#11011](axios/axios#11011), [#11012](axios/axios#11012), [#11013](axios/axios#11013), [#11014](axios/axios#11014), [#11015](axios/axios#11015), [#11016](axios/axios#11016), [#11017](axios/axios#11017), [#11026](axios/axios#11026)) #### 🌟 New Contributors We are thrilled to welcome our new contributors. Thank you for helping improve axios: - [@webdevelopersrinu](https://github.com/webdevelopersrinu) ([#10913](axios/axios#10913)) - [@sijie-Z](https://github.com/sijie-Z) ([#10993](axios/axios#10993)) - [@bartlomieju](https://github.com/bartlomieju) ([#11023](axios/axios#11023)) - [@JSap0914](https://github.com/JSap0914) ([#11019](axios/axios#11019)) [Full Changelog](axios/axios@v1.18.0...v1.18.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Co-authored-by: leuwen-lc <[email protected]> Reviewed-on: https://codeberg.org/leuwen-lc/rhdemo/pulls/178

devareddy05 requested a review from jasonsaayman as a code owner May 21, 2026 19:38

cubic-dev-ai Bot reviewed May 21, 2026

View reviewed changes

devareddy05 mentioned this pull request May 21, 2026

socketPath feature is broken at 1.7.7 #6611

Closed

devareddy05 force-pushed the fix/6611-socketpath-path-only-url branch from 73c1dbc to 181b089 Compare May 23, 2026 19:13

jasonsaayman assigned devareddy05 May 24, 2026

jasonsaayman added priority::medium labels May 24, 2026

devareddy05 force-pushed the fix/6611-socketpath-path-only-url branch 2 times, most recently from fa1650a to 8610d28 Compare May 25, 2026 08:05

fix(http): accept path-only url when socketPath is set (axios#6611)

3a10764

devareddy05 force-pushed the fix/6611-socketpath-path-only-url branch from 8610d28 to 3a10764 Compare May 26, 2026 19:53

jasonsaayman requested changes May 27, 2026

View reviewed changes

Comment thread lib/adapters/http.js Outdated

Comment thread tests/unit/adapters/http.test.js

jasonsaayman added the status::changes-requested A reviewer requested changes to the PR label May 27, 2026

fix(http): read socketPath via own-property guard to avoid prototype …

e23b20b

…pollution (axios#6611)

devareddy05 requested a review from jasonsaayman June 11, 2026 16:42

Merge remote-tracking branch 'origin/v1.x' into fix/6611-socketpath-p…

348c070

…ath-only-url # Conflicts: # PRE_RELEASE_CHANGELOG.md # lib/adapters/http.js

jasonsaayman removed priority::medium labels Jun 14, 2026

jasonsaayman added 2 commits June 16, 2026 20:14

test(http): tighten socketPath regression coverage

72cb610

Merge branch 'v1.x' into fix/6611-socketpath-path-only-url

02d8f0b

jasonsaayman approved these changes Jun 16, 2026

View reviewed changes

jasonsaayman merged commit 01e869d into axios:v1.x Jun 16, 2026
26 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(http): accept path-only url when socketPath is set (#6611)#10930

fix(http): accept path-only url when socketPath is set (#6611)#10930
jasonsaayman merged 5 commits into
axios:v1.xfrom
devareddy05:fix/6611-socketpath-path-only-url

devareddy05 commented May 21, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

jasonsaayman left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

devareddy05 commented May 21, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked issue

Changes

Checklist

Summary by cubic

Description

Docs

Testing

Semantic version impact

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jasonsaayman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

devareddy05 commented May 21, 2026 •

edited by cubic-dev-ai Bot

Loading