CVE-2026-39865: axios Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-39865 is a medium (CVSS 5.9) Uncontrolled Resource Consumption vulnerability in axios. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-04-2026PublishedVulnerability first disclosed.
- 27-04-2026Last modifiedVulnerability information updated.
Description
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
+0.02 pp
From 0.73% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAxios
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
Affected systems
Chainguard6 products
- kibana-7< 7.17.29-r8
- kubeflow-centraldashboard< 1.10.0-r19
- langfuse-2< 2.95.12-r19
- langfuse-2-worker< 2.95.12-r19
- langfuse-fips-2< 2.95.12-r22
Axios1 product
- axios≥ 1.13.0, < 1.13.2 | ≥ 1.0.0, < 1.13.2
Debian1 product
- node-axiosAll versions (No fix recorded) | < 1.13.2+dfsg-1
Npm1 product
- axios≥ 1.13.0, < 1.13.2
Ubuntu1 product
- node-axiosAll versions (No fix recorded)
Wolfi1 product
- kubeflow-centraldashboard< 1.10.0-r19
6 vendors · 11 products
References
9 links- github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/axios/axiosPACKAGE