Description
Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios.
This affects applications that use the Node HTTP adapter with httpVersion: 2.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.13.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header - CVE-2026-59892
- Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - CVE-2026-44496
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
- Axios: Excessive recursion in formDataToJSON can cause denial of service - CVE-2026-67313
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026