# StormFetch 1.16.3 vs Axios 1.16.1

Comparison date: 2026-07-20.

This is an evidence-based engineering comparison, not a claim that one client wins every project. Axios still has the larger ecosystem, longer production history, and broader third-party integration footprint. StormFetch 1.16.3 targets a stronger built-in application platform and secure-by-default policy surface while keeping zero runtime dependencies.

Official comparison sources:

- [Axios request configuration](https://axios-http.com/docs/req_config)
- [Axios interceptors](https://axios-http.com/docs/interceptors)
- [Axios cancellation](https://axios-http.com/docs/cancellation)
- [Axios multipart bodies](https://axios-http.com/docs/multipart)
- [Axios v1.16.1 release](https://github.com/axios/axios/releases/tag/v1.16.1)
- [Axios security advisories](https://github.com/axios/axios/security/advisories)

## Capability matrix

| Capability | Axios 1.16.1 | StormFetch 1.16.3 | Result |
| --- | --- | --- | --- |
| Browser and Node requests | Yes | Yes | Parity |
| React Native | Supported | Dedicated native-safe entry point, runtime detection, native files, async persistence, background-transfer contracts | StormFetch broader built-in surface |
| Deno and Bun | Supported | Dedicated runtime detection and Fetch path with CI checks | Parity with explicit StormFetch diagnostics |
| HTTP QUERY method | Yes | `query()` and `QUERY()` with typed body | Parity |
| TypeScript | Bundled declarations | End-to-end body/response generics, endpoint maps, schemas, generated SDK CLI | StormFetch broader SDK tooling |
| Interceptors | Request/response, conditional request execution | Request/response/error, `runWhen`, `once`, `prepend`, eject function | StormFetch broader lifecycle controls |
| Cancellation | AbortSignal and legacy compatibility | AbortSignal across adapters, polling, batch, queues, native tasks | StormFetch broader package integration |
| Retries | Usually added separately | Built-in safe/unsafe policies, jitter hooks, `Retry-After`, idempotency support | StormFetch built in |
| Cache and dedupe | Usually added separately | Memory/web/async cache, tags, stale-while-revalidate, in-flight dedupe | StormFetch built in |
| Offline mutations | Not core | Durable queue, dependencies, idempotency keys, conflict handling, dead letters | StormFetch built in |
| Circuit breaker and concurrency | Not core | Built-in circuit breaker, global/per-host concurrency, priority, rate limits | StormFetch built in |
| HTTP/1.1, HTTP/2, Fetch, XHR | Multiple adapters | Multiple adapters plus custom transport and mock server | Parity; StormFetch adds integrated mocks |
| Upload/download progress | Yes | Browser and Node progress with bytes, rate, ETA, direction; native transfer contracts | StormFetch richer event shape |
| Buffered body limits | Yes | Secure 10 MB defaults on uploads/responses | Parity with safer StormFetch defaults |
| Streamed body limits | Enforced in current adapters | Enforced for Node and Fetch upload/download streams and XHR progress | Parity |
| Decompression bombs | Opt-in limit guidance | Byte cap plus `maxDecompressionRatio: 100` by default | StormFetch safer default |
| Nested form serialization | Bounded depth and key styles | Bounded depth, dot/bracket/index styles, circular and dangerous-key rejection | Parity plus explicit key guard |
| Header injection | Hardened | Strict token validation, control-byte rejection, null-prototype normalized headers | Parity |
| Prototype-pollution defense | Hardened own-property/config paths | Own-property URL/default normalization, strict XSRF boolean, null-prototype headers, dangerous form-key rejection | Parity for exposed StormFetch paths |
| XSRF | Cookie/header configuration | Same-origin by default plus strict boolean opt-in and credential policies | StormFetch adds policy layer |
| Redirect credential safety | Hardened | Cross-origin credential stripping, downgrade/private-host policy, host caps, `beforeRedirect` | StormFetch broader policy layer |
| Proxy and `NO_PROXY` | Mature proxy support | Explicit/env opt-in proxy, normalized bypass, HTTPS CONNECT | Axios has longer proxy ecosystem history; StormFetch is secure opt-in |
| Unix sockets | `allowedSocketPaths` | `socketPath` requires `allowedSocketPaths` | Parity |
| SSRF controls | Targeted transport hardening | Host/CIDR/DNS allow/deny rules, cloud-metadata block, private-network block, redirect revalidation | StormFetch broader built-in controls |
| TLS/mTLS/pinning | Node transport configuration | TLS/mTLS plus certificate pin allowlist | StormFetch built in |
| Error model | Structured error and stable codes | Structured redacted error, stable catalog, request ID/duration, native network code preservation | StormFetch richer diagnostics |
| Debugging | Mature community tooling | Redacted history, replay, curl, HAR, DevTools, events, metrics, OpenTelemetry bridge | StormFetch broader built in |
| Supply chain | SHA-pinned actions, OIDC/provenance hardening | SHA-pinned actions, no CI caches, OIDC provenance, CodeQL, Semgrep, zizmor, dependency review, SBOM | StormFetch adds more release gates |
| Runtime dependencies | Has runtime dependency graph | None | StormFetch smaller trust surface |
| Ecosystem and adoption | Very large and mature | Newer and smaller | Axios advantage |

## Security defaults that differ

StormFetch applies finite request and response limits, a decompression-ratio limit, same-origin XSRF behavior, redirect credential stripping, socket-path allowlisting, redacted diagnostics, and no environment proxy trust unless enabled. These defaults reduce the number of protections an application must remember to configure.

Use a project-specific security policy as well:

```ts
import { createStormFetchClient } from 'stormfetch';

const api = createStormFetchClient({
  baseURL: 'https://api.example.com',
  maxBodyLength: 5 * 1024 * 1024,
  maxContentLength: 10 * 1024 * 1024,
  maxDecompressionRatio: 50,
  maxFormDepth: 16,
  security: {
    allowedHosts: ['api.example.com'],
    allowHttp: false,
    allowPrivateNetwork: false,
    blockCloudMetadata: true,
    validateDns: true,
  },
});
```

## Honest selection guidance

Choose StormFetch when you want one dependency-free package for typed HTTP, React/React Native, security policy, retries, cache, offline mutations, observability, mocks, SDK generation, and DevTools.

Choose Axios when an existing application depends on Axios-specific plugins, adapters, mock libraries, or team conventions and replacing that ecosystem would cost more than the added StormFetch capabilities.

No library can be guaranteed “best in every comparison.” The release gate for StormFetch is therefore executable behavior: typecheck, cross-runtime builds, real transport tests, browser tests, security tests, installed-tarball tests, and performance budgets.