Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | >= 1.13.0, < 1.20.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.20.0-1 | — |
| Debian 13 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-axios | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.12-0.3.hum1 | RHSA-2026:74871 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.6-0.6.hum1 | RHSA-2026:74869 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.9.hum1 | RHSA-2026:74872 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-centraldashboard | 2.0.0-r5 | — |
| Wolfi rolling | langfuse-3 +1 | 3.225.11-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r8 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.9-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.8.0-r8 | — |
| Wolfi rolling | prism | 5.16.0-r13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 1.13.0, < 1.20.0 | 1.20.0 | GHSA-542g-h47m-68v8 |
Advisories 5
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-4410 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:74871 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74869 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:74872 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 3, 2026