CVE-2026-101901

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

No known exploitation. EPSS puts it in the 30th percentile. No fix published yet.

CVSS —Not scored EPSS percentile30th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-28Updated 2026-10-01Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

AxiosAffected: >= 1.13.0, < 1.20.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your developer or vendor whether your application uses Axios to make HTTP/2 requests (setting httpVersion: 2).
Have them check the exact Axios version in use — versions from 1.13.0 up to before 1.20.0 are affected.
If HTTP/2 requests aren't required, have them disable HTTP/2 mode in Axios as a temporary workaround.
Ask them to watch for an official vendor security advisory confirming a fixed version, since none is formally confirmed yet.
Add automatic restart/monitoring for the affected service so it recovers quickly if it does crash.

May need vendor or contractor work

What it is

From the CVE record

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.

In plain language

Written by AI from the record

This is a flaw in Axios, a very common tool that apps use to talk to other servers over the internet, where a bad or broken server response can crash your application — if you use it, you should check with your developer soon.

Axios versions 1.13.0 through before 1.20.0 fail to attach an error handler to the Node.js HTTP/2 ClientHttp2Session during initialization or reuse, so an 'error' event from a remote server escapes normal promise rejection handling and can crash the Node.js process, causing denial of service.

If you're affected

Node.js process crashes
Service outage/downtime
Lost sales during downtime
Customer-facing app unavailable

What is it

Axios is like the postal service your software uses to send and receive messages with other websites and servers. This bug means that if the other side sends back a certain kind of broken reply, the mail carrier (your application) can collapse entirely instead of just reporting a failed delivery — taking your whole service offline until someone restarts it.

Who is affected

This matters to you if any software you run or had built for you uses Axios to make outgoing web requests, especially if it's configured to use the newer HTTP/2 protocol. It affects Axios versions 1.13.0 up to but not including 1.20.0. This is only a practical risk if your application is actually making HTTP/2 requests through Axios and is reachable or depends on responses from external or attacker-influenced servers.

How urgent is it

This issue is attracting sustained attention from security researchers and threat-tracking groups, and it only takes a single malformed server response to crash the affected application — there's no login or special access needed by an attacker. No mass exploitation has been confirmed yet, but given how easy this is to trigger and how widely Axios is used, you should treat this as something to act on now rather than wait.

What to do — in detail

Inventory all services that use Axios and determine which ones set httpVersion: 2 or otherwise negotiate HTTP/2 connections.
Confirm the installed Axios version; versions ≥1.13.0 and <1.20.0 are affected per the underlying advisory, though no fixed-version patch has been independently confirmed in current fix-tracking data — check the official Axios GitHub security advisories directly before relying on any specific version number.
As an interim workaround, avoid enabling HTTP/2 mode in Axios configurations, or wrap outbound HTTP/2 request logic with process-level uncaughtException/domain handling and automatic process supervision (e.g., via a process manager that restarts on crash) to limit downtime impact.
No CISA KEV listing exists for this CVE, so there is no federal remediation deadline; prioritize based on your own exposure (services making outbound HTTP/2 calls to third parties or user-controlled endpoints).
Monitor for process crashes/restarts correlated with outbound HTTP/2 traffic, and subscribe to Axios's official release notes/security advisories for the confirmed patched version.

Technical context

Weakness class: CWE-400 (Uncontrolled Resource Consumption / Denial of Service). The root cause is a missing 'error' event listener on the underlying Node.js ClientHttp2Session object during Axios's HTTP/2 session setup or reuse path; an unhandled error event in Node.js is fatal by default, crashing the process. This CVE is not listed in CISA's KEV catalog, and no public exploit code has been identified. EPSS places predicted exploitation likelihood at 0.4% (30th percentile) with a flat trend, indicating low near-term mass-exploitation probability — though this reflects prediction, not observed activity. Press attention has been sustained in broader vulnerability roundups referencing the actor ShinyHunters, but this reflects coverage/context rather than confirmed exploitation of this specific flaw. No patch/fix version has been confirmed through current fix-tracking data; verify directly against upstream Axios security advisories before upgrading to a specific version number.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.