Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.
Published: 2026-09-28
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Network bypass via proxy and DNS policy evasion
Action: Patch immediately
AI Analysis

Impact

Axios allows the HTTP/2 adapter to skip the proxy and DNS lookup settings supplied by the caller or derived from the environment. The library executes http2.connect() directly, so a request configured to use a proxy or a custom DNS resolution policy could still reach the destination unmediated. This bypass constitutes a DNS and proxy bypass weakness (CWE‑918), potentially allowing an application to reach endpoints outside the intended tunnel, leaking data, or sidestepping security controls.

Affected Systems

Axios 1.13.0 through 1.20.0, used in browser and Node.js environments. Any project that includes axios between those versions is vulnerable.

Risk and Exploitability

The CVSS score is 7, representing high severity. EPSS is not available, and the issue is not listed in CISA KEV. An attacker can exploit this by sending an HTTP/2 request that triggers the erroneous path. When the application is configured to use a proxy or a custom DNS resolver, the HTTP/2 request can still be sent directly to the target, bypassing the intended controls. The vulnerability is remotely exploitable through the application's normal request flow without additional input.

Generated by OpenCVE AI on September 28, 2026 at 19:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Axios to v1.20.0 or later.
  • Ensure Axios configuration enforces proxy and DNS lookup policies before establishing an HTTP/2 connection; if unable to enforce, disable HTTP/2 usage.
  • Monitor outbound connections for unexpected destinations and block them if they violate policy.

Generated by OpenCVE AI on September 28, 2026 at 19:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3pq3-5fj3-cg6v Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
History

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

threat_severity

Moderate

Mon, 28 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Axios
Axios axios
Vendors & Products Axios
Axios axios

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.
Title Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Axios Axios
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T17:50:05.961Z

Reserved: 2026-09-28T15:55:37.906Z

Link: CVE-2026-101898

cve-icon Vulnrichment

Updated: 2026-09-28T17:49:56.527Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T18:17:17.860

Modified: 2026-09-30T19:38:27.293

Link: CVE-2026-101898

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-28T17:10:16Z

Links: CVE-2026-101898 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:15:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)