Patch Forecast
Amber warning
Patch this week.

CVE-2026-101901 · GHSA-542g-h47m-68v8

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Risk score
70/100
CVSS
8.2 v4.0
Exploit chance (30 days)
0.4%
Published
28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initial…
Affected
axios (npm) >= 1.13.0, < 1.20.0
Fix
Upgrade axios to 1.20.0 or later.
Exploitation
Public proof of concept

Story map

Story map: axiosTHE FLAWSTHE FIXCVE-2026-101901Axios: Denial of Service viaUnhandled 'error' Event inHTTP/2 ClientHttp2Session…CVSS 8.2 · EPSS 0%CVE-2026-101906Axios: ReDoS (O(N²)) inshouldBypassProxy hostnormalization, reachable via…CVSS 8.2 · EPSS 0%CVE-2026-101903Axios: ReDoS in fromDataURIdata: URL parser freezes theNode event loop (DoS)CVSS 8.2 · EPSS 0%CVE-2026-101909Axios: Prototype PollutionGadget in axios toFormDataOptionsCVSS 8.3 · EPSS 0%Upgrade axios1.20.0 · 0.34.0or later on your release lineWho is exposedaxios (npm) >= 1.15.0, < 1.20.0AMBER · PATCH THIS WEEKaxiosAxios is a promise-based HTTPclient for the browser andNode.js. From 1.15.0 until 1.20.0,Axios shouldBypassProxy appliesa quadratic trailing-dot regularexpression to redirecthostnames. HTTP_PROXY or…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)252 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

axios: Amber, patch this week. Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Locat…

The flaws

  • CVE-2026-101901: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (CVSS 8.2 · EPSS 0%)
  • CVE-2026-101906: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (CVSS 8.2 · EPSS 0%)
  • CVE-2026-101903: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (CVSS 8.2 · EPSS 0%)
  • CVE-2026-101909: Axios: Prototype Pollution Gadget in axios toFormData Options (CVSS 8.3 · EPSS 0%)

The fix

Upgrade axios: 1.20.0 · 0.34.0 or later on your release line

Who is exposed: axios (npm) >= 1.15.0, < 1.20.0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.2 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
axiosnpm>= 1.13.0, < 1.20.01.20.0

References

Original description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.

Last activity 28 Sep 2026. Patch Forecast updates every hour.