CVE-2026-101898

Executive Summary

CVE-2026-101898 is a server-side request forgery (SSRF)-adjacent policy bypass in the Axios HTTP client affecting versions 1.13.0 through prior to 1.20.0. The vulnerability occurs when Axios sets up HTTP/2 requests: the library does not consistently apply proxy settings or a caller-supplied DNS lookup policy before invoking http2.connect(). Applications that rely on Axios to enforce proxy routing or DNS resolution controls may silently bypass those protections for HTTP/2 requests. The impact is a confidentiality and integrity risk to the request path — traffic may be routed outside an intended proxy or resolved against a DNS policy other than the one the application configured.

Technical Analysis

Axios is a promise-based HTTP client used in browser and Node.js environments. In the affected version range (1.13.0 to before 1.20.0), the HTTP/2 request setup path fails to consistently apply two classes of caller-supplied configuration:

1. Proxy configuration — When a request uses httpVersion: 2 together with an explicit config.proxy setting or environment-derived proxy settings, the HTTP/2 code path can establish a connection without honoring the configured proxy behavior.
2. DNS lookup policy — When the caller supplies a config.lookup DNS policy, that policy may not be applied before the call to http2.connect().

The root cause is a divergence between the HTTP/1.x request path and the HTTP/2 request path: the HTTP/2 connection establishment routine reaches http2.connect() without the configuration plumbing that the default path uses to enforce proxy and DNS controls. This is classified as CWE-918 (Server-Side Request Forgery) because the practical effect is that an application's intended request-routing controls — the mechanism by which SSRF defenses are typically implemented — can be circumvented at the transport-setup layer.

Note: The NVD description does not disclose specific internal function names beyond http2.connect(), nor does it specify whether the bypass is triggered on all HTTP/2 requests or only a subset (for example, only the first connection in a given context). No code-level details beyond the above are asserted here.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-101898. The attack chain below is described at the vulnerability-class level and is inferred strictly from the NVD description.

1. Reconnaissance / target identification — An attacker identifies an application that (a) runs on Node.js, (b) uses an affected Axios version (1.13.0 through prior to 1.20.0), and (c) uses Axios with httpVersion: 2. The attacker must also determine that the application relies on Axios proxy settings or a caller-supplied config.lookup DNS policy as a security control. This is typically an application that fetches remote resources on behalf of users (webhook callers, URL preview generators, integration connectors).

2. Triggering the flaw class — The attacker induces the application to issue an outbound HTTP/2 request whose destination is influenced by attacker-controlled input, or to a destination the application intends to restrict. Because the HTTP/2 setup path does not consistently apply the configured proxy or the caller-supplied config.lookup policy before http2.connect(), the request may be resolved and/or connected without those controls.

3. Execution mechanism — At the vulnerability-class level, this is a request-routing policy bypass: the request that the application believes will travel through its proxy or resolve under its DNS policy instead proceeds via the unguarded HTTP/2 connect path. No payload beyond the request itself (a URL or request parameter) is required, and no memory-corruption or code-execution primitive is involved.

4. Post-exploitation impact — The resulting connection can (i) bypass the intended proxy route, potentially leaking the request and its metadata outside the organization's egress controls, and (ii) bypass the caller-supplied DNS resolution policy, which may allow resolution to internal or otherwise restricted destinations. In SSRF terms, this weakens or defeats the primary control used to prevent requests to unintended hosts.

Impact Assessment

Per the assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N:

• Attack Vector (Network) — exploitation is possible remotely over a network.
• Attack Complexity (High) — the attacker must have a way to influence the request destination and the target must use HTTP/2 with the relevant configuration.
• Privileges Required (None) / User Interaction (None) — the attacker does not need credentials or user action.
• Scope (Changed) — the vulnerable component's security controls (proxy/DNS policy) are bypassed, affecting resources beyond the component itself.
• Confidentiality (High) / Integrity (High) — requests may reach unauthorized destinations or transit outside the configured proxy.
• Availability (None) — no denial-of-service impact is described.

Business impact: Applications using affected Axios versions to fetch untrusted URLs while relying on proxy enforcement or DNS pinning for SSRF protection may be exposed to request routing to internal services. Organizations subject to egress-control or data-residency requirements may see those controls bypassed at the HTTP/2 transport layer.

No EPSS score is available (not yet scored by FIRST.org). CVE-2026-101898 is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Axios HTTP/2 Proxy or DNS Policy Bypass Attempt (CVE-2026-101898)
id: 5f3c1a92-7d21-4c8e-9b4a-2e6f0d1c7a55
status: experimental
description: Detects Node.js processes using Axios versions 1.13.0-1.19.x with HTTP/2 connections that may bypass proxy or config.lookup DNS policy.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101898
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.101898
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/node'
      - '/nodejs'
  selection_args:
    CommandLine|contains:
      - 'axios'
  selection_version:
    CommandLine|contains:
      - '1.13.'
      - '1.14.'
      - '1.15.'
      - '1.16.'
      - '1.17.'
      - '1.18.'
      - '1.19.'
  condition: selection_proc and selection_args and selection_version
fields:
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate applications pinned to affected Axios versions
level: medium

YARA Rule

rule CVE_2026_101898_Axios_HTTP2_Policy_Bypass
{
    meta:
        description = "Detects Axios source trees referencing httpVersion 2 and http2.connect without proxy/lookup enforcement"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101898"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "httpVersion" ascii wide
        $b = "http2.connect" ascii wide
        $c = "config.lookup" ascii wide
        $d = "config.proxy" ascii wide
        $e = "axios" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0A0A or true and
        $e and $b and ($a or $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101898 Axios HTTP/2 Proxy/DNS Policy Bypass Attempt"; flow:established,to_server; http.header; content:"HTTP/2"; content:"proxy-authorization"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-101898; sid:2026101898; rev:1;)

Elastic Detection

process where process.name in ("node", "node.exe", "nodejs") and
  process.args : "*axios*" and
  process.args regex "1\\.(1[3-9])\\."

Splunk SPL Query

index=endpoint (process_name=node OR process_name=node.exe OR process_name=nodejs)
| where match(process_command_line, "axios") AND match(process_command_line, "1\.(1[3-9])\.")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_command_line, user
| eval severity="medium", cve="CVE-2026-101898"
| table first_seen, last_seen, host, user, process_command_line, severity, cve

Wazuh OSSEC Rule

<group name="cve,axios,">
  <rule id="101898" level="7">
    <decoded_as>json</decoded_as>
    <field name="command">node|nodejs</field>
    <description>CVE-2026-101898: Node.js process using potentially vulnerable Axios version with HTTP/2 request setup</description>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101898</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Identify all Node.js applications resolving Axios versions 1.13.0 through prior to 1.20.0 (check package.json / lockfiles). Priority should go to services that fetch user-supplied or remotely-supplied URLs.
   • Where SSRF protection depends on Axios config.proxy or config.lookup, add an independent, transport-level enforcement layer (e.g., an outbound proxy or egress firewall) that does not rely on client-library configuration for HTTP/2.
   • Prefer httpVersion: 1.1 or disable HTTP/2 in Axios configurations until the library is updated, if the application does not require HTTP/2.

2. Patch / upgrade steps

   • The vendor states the issue is fixed in Axios version 1.20.0. Upgrade to 1.20.0 or later.
   • Regenerate lockfiles and redeploy dependent services. Note that no vendor advisory, registry diff, or CVE-to-patch mapping is available from tracked sources; validate the fix against the official Axios release before relying on it.

3. Long-term hardening

   • Enforce internal-network egress restrictions at the network layer so that host-routing controls do not depend solely on an HTTP client's configuration.
   • Pin dependency versions and enable automated dependency-scanning alerts for security advisories affecting Axios.
   • Log and alert on http2.connect usage in application code where proxy or DNS policy enforcement is expected.

References

• NVD — CVE-2026-101898: https://nvd.nist.gov/vuln/detail/CVE-2026-101898
• Axios project (GitHub): https://github.com/axios/axios
• Axios releases (verify 1.20.0 fix): https://github.com/axios/axios/releases
• MITRE CWE-918 — Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• FIRST EPSS (no score currently published for this CVE): https://www.first.org/epss/

No threat actor campaigns, exploit-in-the-wild evidence, or PoC code have been observed for CVE-2026-101898 as of this report. The vulnerability is not listed in CISA KEV.