Skip to content

fix: validate timeout is non-negative finite number#7444

Open
Nicknamess96 wants to merge 1 commit intoaxios:v1.xfrom
Nicknamess96:fix/validate-timeout-config
Open

fix: validate timeout is non-negative finite number#7444
Nicknamess96 wants to merge 1 commit intoaxios:v1.xfrom
Nicknamess96:fix/validate-timeout-config

Conversation

@Nicknamess96
Copy link
Copy Markdown

@Nicknamess96 Nicknamess96 commented Feb 25, 2026

Summary

Validates config.timeout early in dispatchRequest before any adapter processes it. Rejects negative, Infinity, and -Infinity values with a clear AxiosError (ERR_BAD_OPTION_VALUE) instead of letting them reach Node.js internals where they cause a confusing RangeError.

Fixes #7428

Motivation

Passing timeout: -1000 crashes with:

RangeError [ERR_OUT_OF_RANGE]: The value of "msecs" is out of range.
    at TLSSocket.setStreamTimeout [as setTimeout] ...

This is confusing because the stack trace points to Node.js internals, not to the axios config. The fix catches this early with:

AxiosError: timeout must be a non-negative number, got `-1000`
    code: 'ERR_BAD_OPTION_VALUE'

Approach

Validation is placed in dispatchRequest.js rather than in individual adapters so that all adapters (http, xhr, fetch) benefit from the check. Non-numeric values (objects, non-numeric strings) are intentionally left to adapter-level handling for backward compatibility (the http adapter uses parseInt to parse string timeouts like '250').

Changes

  • lib/core/dispatchRequest.js: Added validateTimeout() that runs before adapter dispatch
  • test/unit/core/dispatchRequest.js: 10 new test cases covering negative, Infinity, -Infinity, NaN, zero, null, undefined, positive, string, and negative string timeouts

Test plan

  • All 252 existing tests pass (npm run test:node)
  • ESLint passes (npm run test:eslint)
  • New tests cover all edge cases
  • Backward compatible: string timeouts like '250' still work

Summary by cubic

Validates config.timeout in dispatchRequest and rejects negative and infinite values with a clear AxiosError (ERR_BAD_OPTION_VALUE). Prevents confusing Node RangeError and applies consistently across all adapters.

  • Bug Fixes

    • Validate timeout before adapter dispatch; reject negative, Infinity, and -Infinity.
    • Keep compatibility: allow numeric strings like '250'; reject negative strings like '-500'.
    • Throw AxiosError with ERR_BAD_OPTION_VALUE and a clear message.
    • Centralized in dispatchRequest so http, xhr, and fetch adapters all benefit.
  • Testing

    • Added unit tests for negative, Infinity/-Infinity, NaN, zero, null, undefined, positive, string '250', and negative string '-500'.
    • All existing tests and ESLint pass.

Written for commit 4e1d5b1. Summary will update on new commits.

Reject negative, Infinity, and -Infinity timeout values early in
dispatchRequest with a clear AxiosError (ERR_BAD_OPTION_VALUE) instead
of letting them propagate to Node.js internals where they cause a
confusing RangeError.

Fixes axios#7428
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

@Nicknamess96
Copy link
Copy Markdown
Author

Friendly ping — this adds validation to reject negative or non-finite timeout values that currently cause silent failures. Tests pass. Happy to address any feedback.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant