Vulnerability details
CVE-2026-101901
axios axios
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
CVSS 4.0
8.2High
Official description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| axios | axios | >= 1.13.0, < 1.20.0 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/axios/axios/pull/11141 x_refsource_MISC
- https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a x_refsource_MISC
- https://github.com/axios/axios/releases/tag/v1.20.0 x_refsource_MISC
- https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8 x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-28
- Last updated
- 2026-10-01
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption