Description
Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy(). The HTTP/2 path builds a session with http2.connect() using only options.http2Options, which drops the top-level lookup, agent, and proxy state.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.13.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning - CVE-2026-67320
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
- Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection - CVE-2026-101905
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026