CVE-2026-101901

Executive Summary

CVE-2026-101901 is an unhandled error vulnerability in the Axios HTTP client, affecting versions 1.13.0 through 1.19.x. The flaw exists in the HTTP/2 session initialization and reuse logic, where a ClientHttp2Session error is not properly caught, escaping normal Promise rejection handling and causing an uncaught exception that terminates the Node.js process. Any application using Axios with httpVersion: 2 is vulnerable to a denial of service attack that requires no authentication.

Technical Analysis

Axios is a widely deployed promise-based HTTP client used in both browser and Node.js environments. It is one of the most popular JavaScript packages in the npm ecosystem, with billions of weekly downloads, making this vulnerability particularly significant for the Node.js server-side community.

The vulnerability resides in the Http2Sessions component, which manages HTTP/2 session lifecycle. When an Axios request is configured with httpVersion: 2, the client establishes and reuses ClientHttp2Session connections. The flaw is characterized by inadequate error handling during session initialization or reuse.

When a ClientHttp2Session emits an error event during initialization or reuse, the error is not captured by Axios's error handling layer. In Node.js, ClientHttp2Session error events that have no registered listener are thrown as uncaught exceptions. Unlike standard request errors that propagate through Promise rejection chains (allowing callers to catch them with .catch() or try/catch around await), these session-level errors bypass the Promise mechanism entirely. The result is an uncaught exception that, in the absence of a global process.on('uncaughtException') handler, terminates the Node.js process.

The root cause maps to CWE-400 (Uncontrolled Resource Consumption) in the sense that the process termination is a consequence of unmanaged error state. The actual CWE nuance is closer to an unhandled exception condition, but CWE-400 is the assigned classification from the data source.

The attack surface is any HTTP/2 server-side Axios client. Trigger conditions include:

• The Axios client is configured with httpVersion: 2
• The ClientHttp2Session emits an error during initialization or reuse
• The application does not have a global uncaught exception handler that safely recovers

Error events on ClientHttp2Session can be triggered by a variety of network and server-side conditions: abrupt connection resets, protocol-level errors (e.g., GOAWAY frames), TLS negotiation failures, malformed HTTP/2 frames, or server-side session termination. A remote attacker who can induce any such condition against the target's Axios-based client can potentially terminate the Node.js process, resulting in denial of service.

Because HTTP/2 connections are frequently pooled and reused, a single session failure can affect multiple pending requests, amplifying the impact.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-101901, and exploitation is described at the vulnerability-class level.

1. Reconnaissance / Target Identification: The attacker identifies a target that makes outbound or peer HTTP/2 requests using Axios. This may be a server-side Node.js application (e.g., API gateway, microservice, BFF layer, webhook dispatcher, or an application acting as an HTTP/2 client to upstream services). Fingerprinting can include observing HTTP/2 usage patterns, response headers, and error behaviors. Because Axios is a client library, the attack surface is on the target's outbound/peer request path rather than its server listener.

2. Triggering the Flaw: The attacker induces a condition that causes the target's Axios ClientHttp2Session to emit an error during initialization or reuse. This could be accomplished by controlling or interfering with a server that the target connects to via HTTP/2 — for example, by abruptly terminating the TCP connection, sending malformed HTTP/2 frames, issuing a GOAWAY frame at an inopportune moment, or causing TLS handshake failures. The specific mechanism depends on the deployment topology and what endpoints the victim's Axios client communicates with.

3. Execution / Impact Realization: The ClientHttp2Session emits an error event for which Axios has not registered an adequate handler. The error is not associated with a Promise rejection, so the application's try/catch or .catch() logic does not intercept it. Node.js raises an uncaught exception. If the application does not have a global uncaught exception handler that performs safe recovery, the Node.js process terminates.

4. Post-Exploitation Impact: The result is a denial of service against the target application. Repeated triggering can cause persistent outages if the application is automatically restarted (e.g., via pm2, systemd, or Kubernetes). If the application is a critical service — such as authentication gateway, API aggregator, or payment processor — the availability impact can be significant. There is no evidence of confidentiality or integrity impact; the flaw is purely availability-affecting.

Impact Assessment

The CVSS v3.1 base score is N/A (not yet assigned by the data source). Based on the vulnerability characteristics, the likely vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which would yield a base score of 7.5 (High). This assessment reflects:

• Attack Vector (Network): The attacker induces errors via network interaction.
• Attack Complexity (Low): No special conditions beyond an HTTP/2 request path.
• Privileges Required (None): No authentication required.
• User Interaction (None): No victim action required beyond normal operation.
• Scope (Unchanged): The vulnerability affects the vulnerable component's process.
• Confidentiality (None): No data exposure.
• Integrity (None): No data modification.
• Availability (High): Process termination results in complete loss of availability for the affected Node.js process.

Blast Radius: Any Node.js application using Axios 1.13.0–1.19.x with httpVersion: 2 is potentially affected. Given Axios's enormous install base, the theoretical blast radius is very large, though the requirement for HTTP/2 usage narrows the practical scope. Applications that do not explicitly set httpVersion: 2 are typically unaffected, since HTTP/1.1 is the Axios default.

Business Impact: Downtime and service unavailability. If the affected process is fronting critical customer workflows, the impact could include SLA breaches, revenue loss, and customer trust erosion. Recurring process restarts can also destabilize dependent systems.

Exploitability: Exploitation requires the attacker to influence the network path or control an HTTP/2 endpoint contacted by the victim. In architectures where the victim connects to attacker-influenced endpoints (e.g., user-configurable webhooks, federated services, or third-party integrations), the attack is more feasible. In closed topologies, exploitation requires a network position or the ability to disrupt HTTP/2 connections.

Detection Guidance

Sigma Rule

title: Possible Axios HTTP/2 Session Error Denial of Service
id: 9a7ecb8c-3f5a-4a4e-9c1d-6b8a2f4e1c3d
status: experimental
description: Detects Node.js process crashes or uncaught exception indicators consistent with CVE-2026-101901 (Axios HTTP/2 session handling).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101901
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: nodejs
detection:
  selection_process:
    EventID: 1
    Image|endswith:
      - 'node'
      - 'nodejs'
  selection_error:
    - 'ClientHttp2Session'
    - 'ERR_HTTP2_STREAM_ERROR'
    - 'ERR_HTTP2_SESSION_ERROR'
    - 'uncaughtException'
    - 'SessionError'
  condition: selection_process and selection_error
level: high
falsepositives:
  - Legitimate HTTP/2 session errors that are handled by the application
  - Development environments with verbose logging

YARA Rule

rule Axios_HTTP2_Unhandled_Session_Error_CVE_2026_101901
{
    meta:
        description = "Detects Axios HTTP/2 session code with potential unhandled error vulnerability (CVE-2026-101901)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101901"
        hash = "N/A"
    strings:
        $s1 = "ClientHttp2Session" ascii
        $s2 = "Http2Sessions" ascii
        $s3 = "httpVersion" ascii
        $s4 = "createConnection" ascii
        $s5 = "session.on('error'" ascii
        $s6 = "ERR_HTTP2_SESSION_ERROR" ascii
    condition:
        uint16(0) == 0x4D5A or $s1 and $s2 or $s3 and $s5
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"CVE-2026-101901 Possible Axios HTTP/2 Client Crash Trigger - GOAWAY or RST on HTTP/2 Session"; flow:established,to_client; content:"|00 00 00 00 00 00 00 00|"; depth:8; byte_test:1,&,0x07,3; classtype:attempted-dos; reference:cve,2026-101901; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101901; sid:2026101901; rev:1;)

alert tcp any any -> any any (msg:"CVE-2026-101901 HTTP/2 Connection Reset Against Axios Client - Potential Session Error Trigger"; flow:established,to_client; flags:R; dsize:0; threshold:type limit, track by_src, count 5, seconds 10; classtype:attempted-dos; reference:cve,2026-101901; sid:2026101902; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name : ("node" or "nodejs")]
  [process where process.name : ("node" or "nodejs") and process.exit_code != 0 and process.args : "*http2*"]

Splunk SPL Query

index=main (sourcetype=nodejs OR sourcetype=node:app OR sourcetype=javascript)
| search ("ClientHttp2Session" OR "ERR_HTTP2_SESSION_ERROR" OR "ERR_HTTP2_STREAM_ERROR" OR "uncaughtException" OR "httpVersion" OR "Http2Sessions")
| stats count min(_time) as firstTime max(_time) as lastTime values(message) as messages by host, source, process
| where count >= 1
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(firstTime)
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="nodejs,axios,http2,dos,">
  <rule id="100901" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">ClientHttp2Session</field>
    <description>CVE-2026-101901: Axios HTTP/2 session error detected - potential DoS trigger (ClientHttp2Session).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,http2,</group>
  </rule>

  <rule id="100902" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">uncaughtException</field>
    <field name="stack">Http2Sessions|ClientHttp2Session</field>
    <description>CVE-2026-101901: Node.js uncaught exception in Axios HTTP/2 session handling - process may terminate.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,http2,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states the issue is fixed in Axios version 1.20.0. Based on the data provided, this version is the remediation target. However, no vendor-published advisory, CVE assignment record, or patch source was available at the time of reporting, so the fix cannot be independently verified from the sources supplied.

1. Immediate Mitigations:

• Register a global process.on('uncaughtException') handler that logs the error and performs a controlled shutdown or restart rather than crashing abruptly. This does not fix the vulnerability but reduces the impact from hard process termination to a managed recovery.
• Avoid using httpVersion: 2 in Axios configurations where HTTP/2 is not strictly required. Falling back to HTTP/1.1 sidesteps the vulnerable code path entirely.
• Where feasible, pin Axios to a version below 1.13.0 or upgrade to 1.20.0 or later if the fix is confirmed available in the target registry.
• Apply process supervision (systemd, pm2, Kubernetes restart policies) so that terminated processes are automatically restarted. This limits the duration of denial of service.
• Place outbound HTTP/2 clients behind a sidecar proxy or reverse proxy that can absorb session-level failures, preventing the application process from being directly impacted.

2. Patch / Upgrade Steps:

• Update Axios to version 1.20.0, which the description indicates contains the fix.
• Review lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to ensure transitive dependencies are also updated.
• Rebuild and redeploy affected Node.js services.
• Validate that HTTP/2 session error handling behaves correctly in a staging environment before production rollout.

3. Long-Term Hardening:

• Adopt dependency scanning (e.g., npm audit, Snyk, Dependabot) and alerting on known vulnerabilities in HTTP client libraries.
• Implement robust uncaught exception and unhandled rejection policies across all Node.js services.
• Enforce HTTP/2 usage only where required, and validate session lifecycle handling in integration tests.
• Monitor Axios release notes and upstream advisories for patch confirmation.
• Implement circuit breakers and timeouts around outbound HTTP/2 calls to reduce the impact of session failures.

References

1. NVD — CVE-2026-101901: https://nvd.nist.gov/vuln/detail/CVE-2026-101901
2. Axios GitHub repository (release notes and issue tracker): https://github.com/axios/axios
3. Node.js HTTP/2 documentation (ClientHttp2Session error events): https://nodejs.org/api/http2.html
4. CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
5. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

Threat actor campaign data and exploit-in-the-wild evidence: none available. CISA KEV: NO. No public PoC, Nuclei template, or exploit code was identified in the provided data.