CVE-2026-39865: Axios HTTP/2 Session Cleanup State Corruption Vulnerability

April 8, 2026 (updated April 27, 2026)

Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This denial-of-service vulnerability affects axios versions prior to 1.13.2 when HTTP/2 is enabled.

References

github.com/advisories/GHSA-qj83-cq47-w5f8
github.com/axios/axios/commit/0588880ac7ddba7594ef179930493884b7e90bf5
github.com/axios/axios/releases/tag/v1.13.2
github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8
nvd.nist.gov/vuln/detail/CVE-2026-39865

Code Behaviors & Features

Detect and mitigate CVE-2026-39865 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →