CVE-2026-39865: Axios HTTP/2 DoS Vulnerability

CVE-2026-39865 Overview

Axios, a widely-used promise-based HTTP client for browser and Node.js environments, contains a state corruption vulnerability in its HTTP/2 session cleanup logic. Prior to version 1.13.2, a malicious server can crash client processes through concurrent session closures by exploiting a control flow error in the Http2Sessions.getSession() method within lib/adapters/http.js. This vulnerability enables Denial of Service attacks against applications using Axios for HTTP/2 communications.

Critical Impact

A malicious server can trigger concurrent HTTP/2 session closures that corrupt internal state, causing the Axios client process to crash and resulting in service disruption for affected applications.

Affected Products

• Axios versions prior to 1.13.2
• Node.js applications using Axios HTTP/2 adapter
• Browser applications utilizing Axios with HTTP/2 connections

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-39865 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39865

Vulnerability Analysis

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which occurs when the application does not properly manage resource consumption during HTTP/2 session cleanup operations. The flaw specifically exists in the session cleanup logic within Axios's HTTP adapter, where improper state management during concurrent session closures leads to memory corruption and process crashes.

The attack requires network access but involves high attack complexity since the attacker must control or compromise the server responding to Axios requests. No user interaction or privileges are required for exploitation. While the vulnerability does not impact confidentiality or integrity, it poses a significant threat to service availability by enabling complete process termination.

Root Cause

The root cause lies in a control flow error within the Http2Sessions.getSession() method located in lib/adapters/http.js. When multiple HTTP/2 sessions are being cleaned up concurrently, the session removal logic fails to properly synchronize access to the sessions array. This race condition allows the internal state to become corrupted, leading to undefined behavior and eventual process crashes.

The session cleanup routine does not properly handle the scenario where multiple session close events occur simultaneously, resulting in attempts to access or modify already-removed session references.

Attack Vector

The attack requires a malicious or compromised server to orchestrate carefully timed HTTP/2 session closure events. When an Axios client connects to such a server:

1. The client establishes multiple HTTP/2 sessions with the malicious server
2. The server initiates concurrent GOAWAY frames or connection resets
3. The Axios HTTP/2 adapter's session cleanup logic processes these closures simultaneously
4. The control flow error during concurrent removal corrupts the sessions array state
5. Subsequent operations on the corrupted state cause the client process to crash

The malicious server exploits the timing window during session array manipulation. By triggering multiple concurrent session closures, the attacker forces the vulnerable code path that corrupts internal state, ultimately causing the Node.js process to terminate unexpectedly. This attack is particularly effective against long-running services that maintain HTTP/2 connections to external endpoints.

Detection Methods for CVE-2026-39865

Indicators of Compromise

• Unexpected Node.js process crashes coinciding with HTTP/2 connections to external services
• Repeated process restarts in production environments using Axios for HTTP/2 requests
• Error logs indicating memory corruption or invalid session state in HTTP adapter modules
• Spike in connection errors or timeouts associated with specific external endpoints

Detection Strategies

• Monitor application logs for unhandled exceptions originating from lib/adapters/http.js or HTTP/2 session management code
• Implement process monitoring to detect abnormal restart patterns in services using Axios
• Audit dependency manifests to identify Axios versions below 1.13.2 across your application portfolio
• Deploy runtime application self-protection (RASP) to detect memory corruption patterns

Monitoring Recommendations

• Configure alerting for sudden process terminations in Node.js services that communicate via HTTP/2
• Establish baseline metrics for HTTP/2 connection lifecycle events to detect anomalous patterns
• Review network traffic for unusual GOAWAY frame patterns from external servers
• Implement health check endpoints with dependency version reporting for vulnerability tracking

How to Mitigate CVE-2026-39865

Immediate Actions Required

• Upgrade Axios to version 1.13.2 or later immediately across all affected applications
• Audit package.json and package-lock.json files to identify all instances of vulnerable Axios versions
• Consider temporarily falling back to HTTP/1.1 for critical services if immediate patching is not possible
• Review and limit connections to untrusted external HTTP/2 endpoints

Patch Information

The vulnerability is fixed in Axios version 1.13.2. The patch addresses the control flow error in the Http2Sessions.getSession() method by implementing proper synchronization during concurrent session cleanup operations. Organizations should update their Axios dependency to 1.13.2 or later by modifying their package.json and running npm update axios or yarn upgrade axios.

For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Configure Axios to use HTTP/1.1 exclusively by disabling the HTTP/2 adapter until patching is complete
• Implement connection timeouts and circuit breakers to limit exposure to malicious servers
• Deploy network-level controls to restrict HTTP/2 connections to trusted endpoints only
• Consider using a proxy layer that terminates HTTP/2 connections before forwarding to application servers

# Update Axios to patched version
npm update axios@1.13.2

# Verify installed version
npm list axios

# For yarn users
yarn upgrade axios@1.13.2