CVE-2026-101898: axios Server-Side Request Forgery (SSRF)
CVSS: 7.0v4.0HighAwaiting analysis
AliasesUBUNTU-CVE-2026-101898DEBIAN-CVE-2026-101898CGA-2c39-gfm6-fvj6CGA-3ph4-849q-2h34CGA-4v9v-9679-w32mCGA-555g-r479-6vjxCGA-678x-p87h-83xwCGA-7x72-76wj-5762CGA-89jx-2rgq-4pmqCGA-8r3j-rrj5-m23mCGA-gfqv-g49v-3wjcCGA-grpw-j8pf-2697CGA-hq6j-5j66-7h5rCGA-hrrr-phvr-xcr9CGA-hwpj-jgh5-h5vxCGA-j462-6w27-j97pCGA-m686-mv6f-x8jgCGA-mcvr-w9fx-8hx9CGA-p4m6-g4qv-88c6CGA-q3wj-6pc4-8qvxCGA-qm4h-vwg9-hr4jCGA-qx27-76j6-926vCGA-r5w2-6wrx-4hw2CGA-r8w8-h3fh-9mqjCGA-vmxp-98fj-87vgCGA-vq5j-h79f-xvh3CGA-vqfp-jcjp-26ggCGA-xmxf-rr48-2mqjGHSA-3pq3-5fj3-cg6vCGA-235m-pjfr-2mp3CGA-263p-6f68-h2vxCGA-272j-hg47-2xxwCGA-2f2w-6qg4-66jpCGA-2rmr-r5gw-jv6hCGA-2vhh-5v8f-hh9cCGA-3495-xxwx-j73rCGA-36vc-48xr-ph9wCGA-3gmx-j228-2p2rCGA-3prm-876r-655vCGA-3q8x-vw87-5757CGA-3r9g-jcq7-7wc9CGA-3x84-g687-rvrgCGA-47w3-gv73-6ppgCGA-4f8w-qvgg-j25wCGA-4qj5-545h-qfcrCGA-4qp7-499h-jp7cCGA-4w4h-w285-m7xcCGA-4x2r-vpxm-jwf6CGA-5h3v-qvhw-wc2rCGA-5m2c-xccj-3r8cCGA-642w-9w7v-29wqCGA-6mv5-qc4g-8w4jCGA-72x6-294h-5pjpCGA-77x6-vhcv-3f8rCGA-795f-wr6q-q7gwCGA-7gm2-8jqq-5h62CGA-7hm8-8m8x-vmhwCGA-7j9j-2vvv-q695CGA-7p3f-p7qg-pq6fCGA-7p63-hrwj-qh4rCGA-7qr9-hhjx-3385CGA-7rcr-8qwr-w6jqCGA-7v3p-hq6c-26r9CGA-7v56-mh2x-v93mCGA-83j9-9rwc-3xhcCGA-84xj-g22f-jcm9CGA-88r9-mpvc-cf5pCGA-8ch5-c9c3-hp58CGA-8g3p-2cr8-jg9jCGA-8p2v-qj59-f2fpCGA-8xrr-5m53-4jxwCGA-9g5h-pp9x-q3xqCGA-9h36-vc47-745mCGA-9rcv-2v88-fgmgCGA-cgrf-g552-7928CGA-cr2g-cqx5-47gjCGA-cx84-w7qj-h9m9CGA-f7mr-fvq2-227qCGA-fh99-rvc8-ffq2CGA-fr2r-f9vr-q6m6CGA-fx39-55h4-629rCGA-g2fx-6v6m-f7whCGA-gm65-f524-rcm8CGA-gvpv-52gf-4v3fCGA-gwx2-f85p-2h7qCGA-gx65-j6q9-5xghCGA-h3wv-mm93-225pCGA-h694-w4r9-mphfCGA-hf64-q27j-9rmqCGA-hgqv-fwfx-7qg9CGA-hv4r-52wm-c9fpCGA-hxcg-75j6-qg9hCGA-j37g-cw3r-946pCGA-j5ph-cw36-p4c3CGA-j884-wv9m-c2vqCGA-j8f8-7wq2-r6jpCGA-jr93-7r6v-f234CGA-m9j5-689j-jr5gCGA-mfvp-5882-vwcfCGA-mhgp-jh9v-jh7pCGA-p8gw-59r9-9f72CGA-pjh3-v366-3h7mCGA-prv5-hfc8-r4crCGA-px2v-v3m9-34m4CGA-qcxc-pqv9-p5hcCGA-qgg6-24f4-4qjxCGA-qm5c-mx64-wq2wCGA-qr7x-9c9h-5787CGA-r559-4pxc-9q36CGA-rcr8-rcvg-f2p9CGA-rh9g-47r9-7v95CGA-rj6g-g437-8jx4CGA-rj7h-hc8f-67rwCGA-rm45-hvqh-rp8hCGA-rv38-fjgg-hh7gCGA-rx3w-8wjq-w63fCGA-v3c3-vmr7-w3x8CGA-v5xg-hjv3-p3w6CGA-v6cr-pjvh-cr57CGA-vj7j-m7r4-jw7xCGA-vm4w-v6c2-f4f4CGA-vwfp-gm4w-7x8fCGA-vxw6-vrmj-q42qCGA-w4xj-q4x4-8x7mCGA-wc9p-qjxm-hr6fCGA-wjqj-xwrv-532rCGA-wmhg-5wpp-wx54CGA-wr68-pp8r-5x54CGA-wr89-j265-rm9pCGA-wr9f-rrpg-rjhjCGA-x73g-mfhg-q2j6CGA-x9v7-8wf2-j7x8CGA-xh5r-q6qj-h8hjCGA-xvjx-chrr-ppvpCGA-xwc7-pqg2-7hfrCGA-hj27-g4f4-vw6wCGA-j6rx-prxr-ccfmCGA-63mm-489r-c8ppCGA-9m8f-5gj7-88f9
Published 28-09-2026Last modified 28-09-2026
Vulnerability summary
CVE-2026-101898 is a high (CVSS 7.0) Server-Side Request Forgery (SSRF) vulnerability in axios. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.
CVSS score
7.0/10
010
High · v4.0 (CVE.org)EPSS score
0.53%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 28-09-2026Last modifiedVulnerability information updated.
Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · NpmEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- OSV · ChainguardEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- NVDNIST7.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
29-09-202619-10-2026
EPSS score0.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard52 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- awx< 24.6.1-r66
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
Wolfi7 products
- kubeflow-centraldashboard< 2.0.0-r5
- langfuse-3< 3.225.11-r2
- langfuse-3-worker< 3.225.11-r2
- lerna< 10.0.1-r8
- nextcloud-server-33< 33.0.9-r1
Axios1 product
- axios≥ 1.13.0, < 1.20.0
Debian1 product
- node-axiosAll versions (No fix recorded) | < 1.20.0-1
Npm1 product
- axios≥ 1.13.0, < 1.20.0
Ubuntu1 product
- node-axiosAll versions (No fix recorded)
6 vendors · 63 products
References
10 links
- github.com/axios/axiosPACKAGE