Platform
nodejs
Component
axios
Fixed in
1.13.1
1.13.2
CVE-2026-39865 describes a denial-of-service (DoS) vulnerability within Axios, a popular JavaScript library for making HTTP requests. This flaw arises from a state corruption bug in the HTTP/2 session cleanup logic, allowing a malicious server to crash the client application. The vulnerability impacts Axios versions 1.13.0 up to, but not including, version 1.13.2, and is triggered when HTTP/2 is enabled. A fix is available in version 1.13.2.
An attacker can exploit this vulnerability by crafting malicious HTTP/2 responses that trigger concurrent session closures. The flawed session cleanup logic in Http2Sessions.getSession() within lib/adapters/http.js leads to a control flow error when removing sessions from the sessions array. This error results in a crash of the Axios client process, effectively denying service to legitimate users. The impact is a complete application outage, potentially affecting all users relying on Axios for HTTP communication. While the vulnerability requires HTTP/2 to be enabled, its widespread adoption in modern web applications increases the potential attack surface.
CVE-2026-39865 was publicly disclosed on 2026-04-08. There are currently no publicly available proof-of-concept (PoC) exploits. The vulnerability's impact is primarily denial-of-service, limiting the immediate risk of data exfiltration or remote code execution. Its inclusion in the NVD and potential addition to CISA KEV will depend on observed exploitation attempts. The EPSS score is likely to be assessed as low to medium, reflecting the need for HTTP/2 and the lack of readily available exploits.
Exploit Status
EPSS
0.02% (3% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-39865 is to upgrade to Axios version 1.13.2 or later. This version contains the corrected session cleanup logic that prevents the state corruption bug. If upgrading is not immediately feasible, consider disabling HTTP/2 support in your Axios configuration as a temporary workaround, although this will impact performance. Monitor your application logs for crashes related to Axios and HTTP/2 sessions. While no specific WAF rules or detection signatures are readily available, generic DoS detection rules may provide some protection. After upgrading, confirm the fix by sending HTTP/2 requests and verifying that the Axios client does not crash under concurrent session closure scenarios.
Update to version 1.13.2 or higher to fix the HTTP/2 session cleanup state corruption vulnerability. This update addresses an issue in session handling that could allow a malicious server to trigger unexpected client closure.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-39865 is a denial-of-service vulnerability in Axios versions 1.13.0 through 1.13.1. A malicious server can crash the client process by exploiting a flaw in HTTP/2 session cleanup.
You are affected if you are using Axios versions 1.13.0 to 1.13.1 and have HTTP/2 enabled. Upgrade to Axios 1.13.2 or later to mitigate the risk.
Upgrade to Axios version 1.13.2 or later. As a temporary workaround, disable HTTP/2 support in your Axios configuration.
As of the current disclosure date, there are no confirmed reports of active exploitation. However, the vulnerability's potential impact warrants prompt remediation.
Refer to the Axios GitHub repository and related security advisories for the latest information and updates regarding CVE-2026-39865.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.