CVE-2026-101901 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within Axios versions ranging from 1.13.0 to 1.20.0 represents a critical flaw in how the library manages HTTP/2 session lifecycle events, specifically concerning ClientHttp2Session objects. Axios is widely utilized as a promise-based HTTP client for both browser environments and Node.js applications, relying heavily on robust error handling mechanisms to maintain application stability during network operations. In this specific context, when an application initiates or reuses an HTTP/2 connection by setting the httpVersion property to 2, it engages with Node.js's underlying native HTTP/2 implementation. The core technical flaw lies in the absence of adequate event listeners for error conditions emitted by the ClientHttp2Session during these initialization or reuse phases. Unlike standard asynchronous operations that are wrapped in Promises and can be caught via try-catch blocks or .catch() handlers, low-level session errors such as protocol violations, connection resets, or internal stream failures emit directly on the session object itself. Because Axios failed to attach a listener for these specific error events, they remained unhandled within the Node.js event loop architecture.
This lack of error handling leads to an uncaught exception scenario that bypasses normal Promise rejection pathways. In Node.js applications, if an error is emitted by an EventEmitter without a corresponding handler, it typically results in the termination of the entire process rather than just failing the specific request or operation. Consequently, this vulnerability allows for a straightforward denial of service attack vector where any condition triggering an HTTP/2 session error can crash the hosting application server. This impact is particularly severe because it does not require complex exploitation techniques; merely inducing conditions that cause the underlying TCP connection to drop abruptly during the handshake or stream creation phase within Axios is sufficient to trigger the unhandled exception and terminate the Node.js process, rendering the service unavailable until manual restart occurs.
From a classification perspective, this issue aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions, as the software fails to validate or handle exceptional states arising from external resources like network sessions. Furthermore, in terms of adversary behavior and defensive mapping, this vulnerability facilitates Denial of Service (DoS) attacks categorized under MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically through resource exhaustion via application crashes rather than traditional volumetric flooding. The failure to implement proper error handling for asynchronous I/O operations is a common pitfall in Node.js development, often referred to as unhandled promise rejections or uncaught exceptions depending on the emission source, but here it manifests due to missing event listeners on native objects exposed through high-level libraries.
To mitigate this vulnerability and prevent similar issues in future implementations, developers must ensure that all EventEmitter instances, particularly those derived from network sockets or sessions, have appropriate error handlers attached before use. For users of Axios within the affected version range, upgrading to version 1.20.0 is the primary remediation strategy as it includes the necessary fixes for session error handling. In environments where immediate patching is not feasible, implementing global uncaught exception listeners in Node.js can serve as a temporary safeguard by logging errors and gracefully shutting down or restarting worker processes rather than allowing them to crash unpredictably. Additionally, developers should review their codebase for any direct interactions with ClientHttp2Session objects to ensure that error events are explicitly listened to and handled, thereby maintaining application resilience against network instability and potential malicious triggers designed to exploit these unhandled paths.