Vulnerability · Published Sep 28, 2026 · Assigned by GitHub_M

CVE-2026-101901Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

High 8.2

In plain English

A high-severity uncontrolled resource consumption in axios from axios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	node-axios	no fix listed	DEBIAN-CVE-2026-101901
Debian:14	node-axios	1.20.0-1	DEBIAN-CVE-2026-101901
Ubuntu:26.10	node-axios	no fix listed	UBUNTU-CVE-2026-101901
npm	axios	1.20.0	GHSA-542g-h47m-68v8

Affected products (as reported)

Vendor	Product	Versions
axios	axios	>= 1.13.0, < 1.20.0

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8 x_refsource_CONFIRM
https://github.com/axios/axios/pull/11141 x_refsource_MISC
https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a x_refsource_MISC
https://github.com/axios/axios/releases/tag/v1.20.0 x_refsource_MISC