Description
Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This denial-of-service vulnerability affects axios versions prior to 1.13.2 when HTTP/2 is enabled.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.13.0, < 1.13.2
- Patched version(s): 1.13.2
References
Could your website be exposed too?
SmartScanner can check your website for Axios HTTP/2 Session Cleanup State Corruption Vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- @workos/authkit-session has an Open Redirect via state-derived redirect target - CVE-2026-42565
- Axios: HTTP adapter streamed responses bypass maxContentLength - CVE-2026-42036
You might also like:
See something that needs correcting? Let us knowUpdated April 27, 2026