CVE-2026-101901: Axios HTTP/2 Session DOS Vulnerability

CVE-2026-101901 Overview

CVE-2026-101901 affects Axios, a promise-based HTTP client for the browser and Node.js. The vulnerability exists in versions 1.13.0 through 1.19.x and stems from missing error handling for ClientHttp2Session objects during HTTP/2 session initialization or reuse. When a request configured with httpVersion: 2 triggers a session error, the unhandled error escapes normal Promise rejection paths. The uncaught error can terminate the Node.js process, resulting in a denial of service condition. The issue is fixed in Axios version 1.20.0 and is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A remote server or intermediate network condition can crash a Node.js application by triggering an HTTP/2 session error during an Axios request, disrupting service availability.

Affected Products

Axios versions 1.13.0 through 1.19.x (Node.js runtime)
Applications using httpVersion: 2 in Axios request configuration
Node.js services depending on Axios for outbound HTTP/2 traffic

Discovery Timeline

2026-09-28 - CVE-2026-101901 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101901

Vulnerability Analysis

Axios added HTTP/2 support that internally creates and reuses ClientHttp2Session instances through the Node.js http2 module. When a request specifies httpVersion: 2, Axios initializes or retrieves a cached session to dispatch the request. The adapter does not attach an error event handler to the session before use.

When the session emits an error event (for example due to protocol errors, TLS failures, or peer resets), Node.js treats it as an unhandled event on an EventEmitter. Unlike Promise rejections, unhandled emitter errors bypass the surrounding async/await machinery and propagate as uncaught exceptions. The Node.js runtime terminates the process by default.

An attacker who controls a target HTTP/2 endpoint, or who can influence session state on a shared connection, can force this error condition and crash the client application.

Root Cause

The root cause is missing session.on('error', ...) registration during ClientHttp2Session initialization and reuse in the Axios HTTP/2 adapter. Errors emitted by the session are not translated into Promise rejections, so no .catch() or try/catch in caller code can intercept them.

Attack Vector

Exploitation requires the target Node.js process to issue an Axios HTTP/2 request to an endpoint the attacker can influence. The attacker triggers a session-level error—such as sending malformed HTTP/2 frames, forcing a GOAWAY with an error code, or causing a TLS handshake failure. The unhandled error terminates the process, denying service to any dependent clients.

The patch in Pull Request #11141 hardens runtime option handling and adjusts adapter behavior. Relevant fixture changes from the fix commit:

javascript

const DEFAULT_CHUNK_SIZE = 64 * 1024;

const DEFAULT_REQUEST_OPTIONS = {
  cache: 'default',
  redirect: 'follow',
  referrer: 'about:client',
  referrerPolicy: '',
  mode: 'cors',
  integrity: '',
  keepalive: false,
  priority: 'auto',
  window: null,
};

const { isFunction } = utils;

Source: GitHub Commit d19040b

javascript

// Set config.method
config.method = (
  utils.getSafeProp(config, 'method') ||
  utils.getSafeProp(this.defaults, 'method') ||
  'get'
).toLowerCase();

Source: GitHub Commit d19040b

Detection Methods for CVE-2026-101901

Indicators of Compromise

Unexpected Node.js process termination with uncaughtException referencing Http2Session or ClientHttp2Session
Crash stack traces containing internal/http2/core.js following outbound Axios calls
Process restarts in supervisors (systemd, PM2, Kubernetes) correlated with HTTP/2 upstream errors

Detection Strategies

Inventory package.json and package-lock.json files for axios versions between 1.13.0 and 1.19.x
Grep source for httpVersion: 2 or Axios instances configured for HTTP/2
Use Software Composition Analysis (SCA) tools to flag vulnerable Axios ranges in build pipelines

Monitoring Recommendations

Track process restart counters and unhandled exception logs for Node.js services
Alert on repeated NGHTTP2_ error codes or GOAWAY frames observed in application logs
Monitor outbound HTTP/2 destinations for anomalous error rates that could indicate exploitation attempts

How to Mitigate CVE-2026-101901

Immediate Actions Required

Upgrade Axios to version 1.20.0 or later across all Node.js services
Audit dependencies for transitive Axios usage and update lockfiles accordingly
Restart affected services after the upgrade to purge cached vulnerable module instances

Patch Information

The fix is included in Axios 1.20.0 via Pull Request #11141 and commit d19040b. Details are available in the GitHub Security Advisory GHSA-542g-h47m-68v8 and the Axios v1.20.0 Release Notes.

Workarounds

Disable HTTP/2 in Axios requests by removing httpVersion: 2 and falling back to HTTP/1.1
Wrap Axios calls in a supervised worker or subprocess that isolates crashes from the main service
Install a global process.on('uncaughtException', ...) handler as a temporary safety net, understanding that this is not a substitute for patching

bash

# Upgrade Axios to the patched release
npm install axios@^1.20.0

# Verify installed version
npm ls axios

# For yarn users
yarn upgrade axios@^1.20.0