Executive brief
Axios is a popular library used by developers to make web requests in Node.js and browser applications. A flaw in how the library handles multiple secure web connections (HTTP/2) allows a malicious server to crash the application using Axios. This results in a denial-of-service, potentially taking down the affected service or application whenever it connects to a compromised or untrusted server.
Technical details
A state corruption vulnerability exists in the Http2Sessions.getSession() method within lib/adapters/http.js. The root cause is a control flow error in the session cleanup logic: when removing a session from the internal sessions array using splice(), the code continues to iterate over the now-modified array if multiple sessions exist. This improper synchronization leads to undefined behavior and process crashes. An attacker-controlled HTTP/2 server can trigger this by establishing multiple concurrent sessions and closing them simultaneously with precise timing. The vulnerability is fixed in version 1.13.2 by ensuring the cleanup loop returns immediately after a session is removed.
Affected products
- Axios Axios >= 1.13.0, < 1.13.2
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: CVE-2026-39865 published to NVD
- 2026-04-08: patched: Version 1.13.2 released