Axios HTTP/2 Session Cleanup State Corruption Vulnerability

Description

Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This denial-of-service vulnerability affects axios versions prior to 1.13.2 when HTTP/2 is enabled.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.13.0, < 1.13.2
• Patched version(s): 1.13.2

References

• GHSA-qj83-cq47-w5f8
• CVE-2026-39865
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• @workos/authkit-session has an Open Redirect via state-derived redirect target - CVE-2026-42565
• Axios: HTTP adapter streamed responses bypass maxContentLength - CVE-2026-42036

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

axios