8.2

CVE-2026-101901: axios Uncontrolled Resource Consumption

CVSS: 8.2v4.0HighAwaiting analysis
AliasesUBUNTU-CVE-2026-101901DEBIAN-CVE-2026-101901CGA-36xj-qx8j-rrgx
Published 28-09-2026Last modified 01-10-2026
Open JSON

Vulnerability summary

CVE-2026-101901 is a high (CVSS 8.2) Uncontrolled Resource Consumption vulnerability in axios. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.8% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v4.0 (CVE.org)
EPSS score
0.38%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3
RHSA-2026:74869RHSA-2026:74871RHSA-2026:74872

Timeline

  1. 28-09-2026
    PublishedVulnerability first disclosed.
  2. 01-10-2026
    Last modifiedVulnerability information updated.

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

29-09-202618-10-2026
EPSS score
0.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard52 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • awx< 24.6.1-r66
  • commercial-gitlab-rails-ee-19.1< 19.1.7-r3
  • commercial-gitlab-rails-ee-19.2< 19.2.7-r1
Wolfi7 products
  • kubeflow-centraldashboard< 2.0.0-r5
  • langfuse-3< 3.225.11-r2
  • langfuse-3-worker< 3.225.11-r2
  • lerna< 10.0.1-r8
  • nextcloud-server-33< 33.0.9-r1
Axios1 product
  • axios≥ 1.13.0, < 1.20.0
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.20.0-1
Npm1 product
  • axios≥ 1.13.0, < 1.20.0
Ubuntu1 product
  • node-axiosAll versions (No fix recorded)

6 vendors · 63 products

References

10 links