EUVD-2026-20501
GHSA-qj83-cq47-w5f8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 5.9 score reflects moderate real-world risk: the attack vector is network-based (AV:N) with no authentication required (PR:N), but the high attack complexity (AC:H) significantly limits practical exploitation. The vulnerability results only in availability impact (A:H), not confidentiality or integrity compromise. The EPSS probability and KEV status were not provided in the intelligence data, but the AC:H requirement indicates that successful exploitation demands precise timing or specific server configurations that a typical attacker cannot easily replicate. While this is not a high-priority zero-day threat, organizations running production Node.js services with HTTP/2 enabled should treat it as a medium-priority patch candidate due to the denial-of-service impact. The attack complexity acts as a natural rate-limiting factor, reducing the likelihood of widespread exploitation compared to simpler attack vectors. |
| Exploit ScenarioDerived | A malicious or compromised HTTP/2 server responds to Axios client requests with crafted protocol frames that trigger concurrent session closure sequences. The attacker times multiple session termination events to create race conditions in the session cleanup array, causing the client Node.js process to encounter a memory access violation or unhandled exception that terminates the application. This scenario requires the attacker to control or intercept the server endpoint and have knowledge of Axios's HTTP/2 session management internals, raising the barrier for opportunistic exploitation but remaining feasible for targeted attacks against known Axios deployments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Denial of service in Axios HTTP/2 client before version 1.13.2 allows unauthenticated remote attackers to crash Node.js applications through malicious HTTP/2 server responses that trigger state corruption during concurrent session closures. The vulnerability exploits a control flow error in session cleanup logic with high attack complexity, making real-world exploitation require specific server-side conditions but posing significant risk to applications relying on HTTP/2.
RemediationAI
Upgrade Axios to version 1.13.2 or later, which contains the fix for the HTTP/2 session cleanup control flow error. For applications unable to immediately upgrade, disable HTTP/2 protocol support in HTTP client configuration or implement network-level filtering to restrict HTTP/2 connections from untrusted servers. Consult the official GitHub Security Advisory (https://github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8) for additional context and verification of patch deployment. Monitor Node.js process stability and implement crash recovery mechanisms as temporary mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Axios is a popular promise-based HTTP client library for Node.js and browsers. The vulnerability resides in the Http2Sessions.getSession() method within lib/adapters/http.js, where HTTP/2 session management logic improperly handles removal of sessions from an internal sessions array. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), indicating a resource management flaw where concurrent session closure operations corrupt internal state. When a malicious HTTP/2 server triggers multiple simultaneous session terminations, the cleanup logic fails to properly synchronize array mutations, leading to use-after-free or index out-of-bounds conditions that crash the Node.js process. This affects all Axios versions before 1.13.2 that support HTTP/2 protocol handling.
Know when Axios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
Blast Radius
ecosystem impact- 25 npm packages depend on axios (15 direct, 10 indirect)
Ecosystem-wide dependent count for version 1.13.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
Exploit-DB