CVE-2026-101901: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

September 30, 2026

Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios.

This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cause an uncaught exception instead of a normal rejected axios request.

References

github.com/advisories/GHSA-542g-h47m-68v8
github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
github.com/axios/axios/pull/11141
github.com/axios/axios/releases/tag/v1.20.0
github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8
nvd.nist.gov/vuln/detail/CVE-2026-101901

Code Behaviors & Features

Detect and mitigate CVE-2026-101901 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →