CVE-2026-39865

What it actually does

Axios versions 1.13.0 through 1.13.1 contain a denial-of-service flaw in the HTTP/2 adapter session cleanup path, specifically in the Http2Sessions.getSession() logic in lib/adapters/http.js. When a Node.js client using Axios communicates with a malicious or compromised HTTP/2 server, concurrent session closures can corrupt Axios' internal session state while entries are being removed from the sessions array. The practical result is a client-side process crash. The issue does not provide code execution, data disclosure, or privilege escalation, but it can cause loss of availability for services, jobs, CLIs, workers, or backend applications that make outbound HTTP/2 requests using affected Axios versions.

Why it matters to the business

Applications that depend on affected Axios versions can be crashed by a hostile HTTP/2 endpoint they call, causing outages, failed background jobs, degraded API integrations, missed webhooks, interrupted automation, or service instability. The risk is most relevant for systems that fetch attacker-influenced URLs, connect to third-party services over HTTP/2, or run long-lived Node.js processes where an unhandled crash affects availability. The CVSS score indicates moderate severity, EPSS is low, it is not listed in CISA KEV, and there is no known ransomware association, so emergency response is generally not required; however, because Axios is widely used across JavaScript applications, dependency inventory and routine patching should be prioritized.

How an attack unfolds

An attacker must be able to cause a vulnerable Node.js application to make an Axios HTTP/2 request to a server the attacker controls or has compromised. The malicious server manipulates HTTP/2 session behavior so that multiple session closures occur concurrently. In affected Axios versions, the session cleanup control flow can remove or mutate entries in the internal sessions array incorrectly, corrupting the HTTP/2 session tracking state. This triggers a crash in the client process, producing a denial of service. Exploitation is network-based and does not require authentication to the client application, but it does require the application to initiate the outbound request to an attacker-controlled or malicious HTTP/2 endpoint and for the vulnerable code path to be used.

How to fix it

Upgrade Axios to version 1.13.2 or later anywhere versions 1.13.0 or 1.13.1 are installed. Because the affected package is often pulled in transitively, review lockfiles such as package-lock.json, yarn.lock, pnpm-lock.yaml, and shrinkwrap files and ensure the resolved Axios version is fixed. If immediate upgrade is not possible, reduce exposure by preventing vulnerable applications from making HTTP/2 requests to untrusted or user-controlled destinations, validating and allowlisting outbound request targets, disabling HTTP/2 for affected call paths where feasible, adding process supervision with safe restart behavior, and isolating workloads that fetch external URLs. These mitigations reduce crash risk but should not replace upgrading.

How to confirm the fix worked

Confirm installed and resolved Axios versions across source repositories, build artifacts, containers, serverless bundles, and deployed Node.js applications. Validate that dependency manifests and lockfiles resolve Axios to 1.13.2 or newer and that no nested dependency still resolves to 1.13.0 or 1.13.1. Useful commands include npm ls axios, yarn why axios, pnpm why axios, npm audit signatures where available, and software composition analysis scans. After patching, rebuild and redeploy affected applications rather than only updating source manifests. Functional validation should include exercising outbound HTTP/2 request paths and confirming the application remains stable during abnormal server-side connection/session closure behavior.

Typical attack path

1. Identify or influence a vulnerable Node.js application that uses Axios 1.13.0 or 1.13.1 for outbound HTTP/2 requests.
2. Get the application to connect to an attacker-controlled or compromised HTTP/2 server, for example through user-supplied URLs, integration configuration, webhook targets, metadata fetching, or dependency/service calls.
3. During the Axios HTTP/2 request lifecycle, force or trigger concurrent HTTP/2 session closures from the server side.
4. Abuse the flawed session cleanup logic in Http2Sessions.getSession() so Axios corrupts its internal sessions array state.
5. Cause the Node.js client process to terminate or crash, resulting in application or worker unavailability until restarted.

How to detect it

To determine whether this was already exploited, review telemetry from Node.js applications using Axios 1.13.0 or 1.13.1 for unexplained crashes, restarts, or uncaught exceptions that coincide with outbound HTTP/2 requests. Relevant sources include application logs, process supervisor logs, container orchestrator events, APM traces, crash dumps, Node.js stderr/stdout, reverse proxy or egress proxy logs, DNS logs, and network flow logs. Focus on repeated process exits or crash loops after connections to unfamiliar external hosts, especially where application features allow user-controlled URLs or third-party integration endpoints. Look for stack traces involving Axios' HTTP adapter, HTTP/2 sessions, session cleanup, or lib/adapters/http.js. Network-level confirmation may be difficult because the exploit outcome is a local client crash, so correlate outbound HTTP/2 connections, abrupt session resets/GOAWAY behavior, and immediate Node.js process termination. There are no known named threat actors, KEV activity, or ransomware campaigns associated with this vulnerability based on the provided data.

• axios@1.13.0
• axios@1.13.1
• node_modules/axios/lib/adapters/http.js
• lib/adapters/http.js
• Http2Sessions.getSession
• Http2Sessions
• ERR_HTTP2
• HTTP/2 session
• GOAWAY
• RST_STREAM
• uncaughtException
• UnhandledPromiseRejection
• Segmentation fault
• process exited with code 1
• CrashLoopBackOff
• npm ls axios

What your security team should do

• Inventory all JavaScript and Node.js applications, containers, serverless packages, and CI/CD build outputs for Axios versions 1.13.0 and 1.13.1.
• Prioritize upgrades to Axios 1.13.2 or later for internet-facing services, backend workers, and applications that make requests to user-supplied or third-party URLs.
• Search dependency lockfiles and software composition analysis results for transitive Axios dependencies and force fixed resolutions where needed.
• Review application functionality that fetches arbitrary URLs, webhook endpoints, integrations, preview links, or remote metadata, and apply outbound destination allowlisting where possible.
• Monitor application crash loops, uncaught exceptions, process exits, and HTTP/2 client errors around outbound Axios activity for signs of attempted denial of service.
• Ensure process managers and orchestration platforms restart crashed Node.js workloads, but treat restarts as resilience only, not remediation.
• Because this vulnerability is not currently in CISA KEV, has low EPSS, and has no known public exploit maturity, handle through prioritized patch management rather than emergency incident response unless affected systems show unexplained crashes.