CVE-2026-101898: Axios HTTP/2 SSRF Vulnerability

CVE-2026-101898 Overview

Axios is a promise-based HTTP client for browsers and Node.js used extensively in server-side applications. CVE-2026-101898 affects Axios versions 1.13.0 through 1.19.x. The HTTP/2 request setup path does not consistently apply proxy settings or caller-supplied DNS lookup policy before calling http2.connect(). Applications that set httpVersion: 2 with config.proxy, environment-derived proxy variables, or config.lookup can issue requests that bypass the intended proxy route or DNS resolution policy. The issue maps to [CWE-918] Server-Side Request Forgery and is fixed in version 1.20.0.

Critical Impact
HTTP/2 requests can bypass configured proxy egress controls and custom DNS resolvers, enabling SSRF-style access to internal services and evading network segmentation policies.

Affected Products

Axios versions 1.13.0 through 1.19.x (Node.js HTTP/2 code path)
Applications using httpVersion: 2 with explicit config.proxy or environment proxy variables
Applications relying on caller-supplied config.lookup DNS policy

Discovery Timeline

2026-09-28 - CVE-2026-101898 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101898

Vulnerability Analysis

Axios supports HTTP/2 requests through a Node.js code path that invokes http2.connect(). In versions 1.13.0 through 1.19.x, this path fails to apply the proxy configuration and DNS lookup policy that the HTTP/1.x adapter honors. When a caller sets config.proxy or defines HTTPS_PROXY in the environment, the HTTP/2 request opens a direct connection to the target host. Similarly, a caller-supplied config.lookup function passed for custom DNS resolution is not propagated into the HTTP/2 session establishment.

The practical outcome is inconsistent egress behavior. Requests intended to flow through a forward proxy for logging, filtering, or authentication instead reach the origin directly. Requests relying on custom DNS resolution — for example, to enforce split-horizon DNS or block internal ranges — resolve using the default system resolver.

Root Cause

The HTTP/2 setup logic in the Node.js adapter does not read and apply the same option pipeline used by the HTTP/1.x path. Proxy resolution and the lookup option are consumed by lower-level HTTP agents that HTTP/2 does not use, so http2.connect() receives an unmodified target and default resolver. This creates a divergence between what the caller configures and what the transport layer actually does.

Attack Vector

An attacker who influences a request URL in an application using Axios HTTP/2 can reach hosts that the proxy layer would otherwise block. In environments where the proxy enforces egress ACLs, this yields SSRF against internal services. Where custom lookup is used to prevent resolution of internal or metadata endpoints, the bypass allows resolution and connection to those endpoints.

javascript

// Patch excerpt from lib/core/Axios.js — hardened option handling
config.method = (
  utils.getSafeProp(config, 'method') ||
  utils.getSafeProp(this.defaults, 'method') ||
  'get'
).toLowerCase();

headers &&
  utils.forEach(
    ['delete', 'get', 'head', 'post', 'put', 'patch', 'query', 'common'],
    (method) => {
      delete headers[method];
    }
  );

config.headers = AxiosHeaders.concat(contextHeaders, headers);
// Source: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a

Detection Methods for CVE-2026-101898

Indicators of Compromise

Outbound HTTP/2 connections from application hosts that bypass the configured forward proxy while HTTP/1.1 traffic from the same host uses it correctly.
DNS queries from application hosts to the system resolver for names that a custom lookup function should have handled or blocked.
Successful connections from application workloads to internal services, cloud metadata endpoints (169.254.169.254), or link-local ranges that egress policy should deny.

Detection Strategies

Inventory Node.js services for Axios versions between 1.13.0 and 1.19.x using npm ls axios or software composition analysis tools.
Flag call sites that combine httpVersion: 2 with proxy, HTTPS_PROXY/HTTP_PROXY, or a custom lookup function.
Correlate proxy access logs against application request logs to identify HTTP/2 requests missing from proxy telemetry.

Monitoring Recommendations

Alert on direct egress from application subnets that should route exclusively through a proxy.
Monitor for HTTP/2 CONNECT/session establishment to unexpected destinations from workloads that declare proxy usage.
Track dependency updates in CI to detect drift back to vulnerable Axios versions.

How to Mitigate CVE-2026-101898

Immediate Actions Required

Upgrade Axios to version 1.20.0 or later across all Node.js services.
Audit application code for httpVersion: 2 usage combined with proxy or lookup configuration and validate behavior after upgrade.
Enforce egress restrictions at the network layer so that proxy bypass by an application library cannot reach internal targets.

Patch Information

The fix is included in Axios 1.20.0. See the GitHub Security Advisory GHSA-3pq3-5fj3-cg6v, the remediation pull request #11141, the fix commit d19040b, and the Axios v1.20.0 release notes.

Workarounds

Force HTTP/1.1 by removing httpVersion: 2 from Axios request configuration until upgrade is possible.
Enforce proxy egress at the container, VM, or network firewall level so that direct connections from application workloads are dropped.
Block resolution of sensitive internal names and metadata IP ranges at the resolver used by the application host, rather than relying solely on config.lookup.

bash

# Upgrade Axios to the patched release
npm install axios@1.20.0

# Verify installed version
npm ls axios