CVE-2026-101898

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

No known exploitation. EPSS puts it in the 43rd percentile. No fix published yet.

CVSS —Not scored EPSS percentile43rd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-28Updated 2026-09-30Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

AxiosAffected: >= 1.13.0, < 1.20.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your developer or vendor whether any internal application, API integration, or internal tool uses the Axios library to make HTTPS requests over HTTP/2.
If Axios is used, check whether the app relies on a configured proxy or custom DNS lookup for security or routing (for example, to restrict where requests can go).
If so, treat this as high priority: these protections may not currently be enforced for HTTP/2 requests, affecting versions 1.13.0 through 1.20.0.
Ask your developer to disable HTTP/2 for outbound Axios requests as a temporary safeguard until an official fixed version is confirmed and released.
Ask them to monitor the Axios project for a security release and apply it as soon as one is published.

May need vendor or contractor work

What it is

From the CVE record

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.

In plain language

Written by AI from the record

A popular tool many apps use to make internet requests (Axios) can silently ignore your proxy and DNS safety settings when using a newer connection mode, and there is currently no official fix — if your business runs custom web apps or internal tools built with it, this needs attention now.

In Axios versions 1.13.0–1.20.0, the HTTP/2 request path can connect without applying caller-configured proxy routing or DNS lookup policy before calling http2.connect(), silently bypassing network egress controls (CWE-918-adjacent SSRF/control-bypass risk), with no fix currently confirmed.

If you're affected

Bypass of network security controls
Internal network exposure (SSRF-style risk)
Data sent outside approved network path
Compliance/firewall policy violations
Operational disruption during remediation

What is it

Think of Axios like a company courier that's supposed to always go through a security checkpoint (a proxy) and only deliver to approved addresses (DNS rules) before leaving the building. This flaw means that when the courier uses a newer, faster delivery route (HTTP/2), it can skip the checkpoint and go straight to its destination without anyone noticing. That matters because the checkpoint may exist specifically to block unsafe or internal destinations.

Who is affected

This matters to you if any website, internal tool, or backend service your business uses was built with the Axios library (versions 1.13.0 through 1.20.0) and depends on proxy settings or custom DNS rules to control where outbound web requests are allowed to go. It's a real concern specifically where those requests use the newer HTTP/2 connection mode — if your app only uses older HTTP/1.1 connections, this issue does not apply.

How urgent is it

This is urgent because the flaw defeats network safety controls without any warning, and there is currently no official patch to close the gap, leaving affected systems exposed for as long as the underlying issue remains unresolved. While there are no confirmed attacks exploiting this specific flaw yet, the combination of silent security-control bypass and no available fix means any business depending on those controls should act now rather than wait.

What to do — in detail

Confirm exposure by identifying all services using axios between versions 1.13.0 and 1.20.0 inclusive, specifically where requests are issued with httpVersion: 2 and the application sets config.proxy, relies on environment-derived proxy variables (HTTP_PROXY/HTTPS_PROXY), or supplies a custom config.lookup DNS resolver for security or routing purposes. Because no fixed version is confirmed in current findings, do not assume 1.20.0 or later resolves the issue without verifying against the official Axios changelog/advisory at time of remediation. As an interim mitigation, force HTTP/1.1 for outbound Axios requests (e.g., via the httpVersion/agent configuration) to restore enforcement of proxy and DNS lookup policy, or enforce network-level egress controls (firewall/NAT-level proxying) independent of application-layer configuration. Monitor the axios GitHub repository and advisory database for a security release addressing this HTTP/2 adapter behavior, and re-test proxy/DNS enforcement after any upgrade. There is no CISA KEV listing or mandated remediation date for this CVE at this time.

Technical context

CWE-918 (Server-Side Request Forgery)-adjacent control-bypass issue in the Axios HTTP/2 adapter: proxy configuration and caller-supplied DNS lookup policy are not consistently applied before http2.connect() is invoked, allowing requests to bypass intended proxy routing or DNS resolution constraints. Affected range: axios 1.13.0 through 1.20.0 (prior to the referenced technical fix version 1.20.0, though this is not confirmed by current patch-tracking data). Not listed in CISA KEV; no public exploit code is on record; predicted exploitation likelihood is low per EPSS with a flat trend. Sustained press/roundup attention referencing the actor ShinyHunters has been observed but does not constitute confirmed exploitation of this specific CVE. Exploit maturity: theoretical/no PoC; attack vector requires an application making HTTP/2 requests via Axios with proxy or DNS-lookup security dependencies.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.