CVE-2026-101901: Axios Denial of Service via Unhandled 'error' Event in HTTP/2 Client

Background

Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It supports various features such as request and response interception, automatic JSON data transformation, and cancellation of requests. The library has built-in support for HTTP/2, which allows for more efficient communication between clients and servers. However, a vulnerability exists in the HTTP/2 implementation that can lead to denial of service (DoS) under certain conditions.

Vulnerability Detail

The vulnerability arises from the way Axios handles error events emitted by the Node.js HTTP/2 ClientHttp2Session. When an error occurs during the initialization of a ClientHttp2Session, Axios does not register an error handler, leading to unhandled exceptions. This can cause the Node.js process to terminate unexpectedly, resulting in a denial of service. The issue primarily affects applications that use the Node HTTP adapter with httpVersion set to 2, allowing an attacker to crash the process by influencing the request destination or operating the destination server.

npm install axios@1.20.0

Workaround

As a temporary workaround, disable Axios HTTP/2 support for untrusted or user-influenced destinations. Use the default HTTP/1.1 adapter instead. Additionally, avoid passing attacker-controlled values into the http2Options configuration. Here is an example of how to configure Axios to use HTTP/1.1:

const axiosInstance = axios.create({
  baseURL: 'https://example.com',
  httpVersion: 1,
});

Conclusion

The CVE-2026-101901 vulnerability in Axios poses a significant risk of denial of service due to unhandled error events in HTTP/2 sessions. It is crucial for developers to update to the patched version or implement workarounds to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.

See every vulnerability recorded for axios →

FAQ