Skip to main content

Axios EUVDEUVD-2026-88367

| CVE-2026-101898 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-09-28 GitHub_M GHSA-3pq3-5fj3-cg6v
SSRF Node.js Axios JavaScript npm
7.0
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

AC:H and S:C because exploitation needs non-default httpVersion:2 plus a security-relevant proxy/DNS policy, and the bypass affects a separate network boundary; impact limited to L (control bypass, no direct system compromise).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SUSE
6.5 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat
4.8 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
POC Analysis Generated
Sep 28, 2026 - 19:24 vuln.today
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: JavaScript added
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: npm added
Patch available
Sep 28, 2026 - 18:01 EUVD
Analysis Generated
Sep 28, 2026 - 18:01 vuln.today
CVE Published
Sep 28, 2026 - 17:10 cve.org
HIGH 7.0

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 25 npm packages depend on axios (15 direct, 10 indirect)

Ecosystem-wide dependent count for version 1.13.0.

DescriptionCVE.org

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.

Articles & Coverage 1

News 15 New Node.js Vulnerabilities - 2 Critical, 13 High Severity Sep 29, 2026

AnalysisAI

Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an application that (1) explicitly opts into HTTP/2 by setting Axios httpVersion:2 (not the default), and (2) depends on either config.proxy, environment-derived proxy settings, or a caller-supplied config.lookup DNS policy as an actual security control (egress inspection/filtering or DNS-rebinding pinning). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a defense-in-depth control-bypass (CWE-918 SSRF-adjacent) in Axios, one of the most widely deployed npm HTTP clients, but real-world risk is moderate and gated by non-default configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to axios 1.20.0, which applies custom config.lookup functions on HTTP/2 connections and stops silently ignoring proxy intent (references: https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v, https://github.com/axios/axios/releases/tag/v1.20.0, PR https://github.com/axios/axios/pull/11141, commit https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Node.js applications for Axios versions 1.13.0 through 1.19.x and identify any callers that set httpVersion: 2 or otherwise opt into HTTP/2 while relying on a configured proxy, environment-derived proxy settings, or a caller-supplied DNS lookup policy as a security boundary; where found, immediately disable HTTP/2 by removing httpVersion: 2 or forcing HTTP/1.1, and reinforce egress filtering and DNS controls at the network or platform layer so Axios cannot bypass them. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

EUVD-2026-88367 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy