Technical impact
Axios is a widely used promise‑based HTTP client for browsers and Node.js. Between versions 1.13.0 and 1.20.0, the library fails to install error handling for the ClientHttp2Session during HTTP/2 session initialization or reuse. When a request specifies httpVersion: 2 and the underlying ClientHttp2Session emits an error, that event bypasses the Promise rejection path and propagates as an uncaught exception. The unhandled error can terminate the Node.js process, resulting in a denial of service.
Affected Systems
The affected product is Axios (axios:axios) in Node.js. Vulnerable releases span from 1.13.0 up to, but not including, 1.20.0. Any Node.js application that imports Axios within this version range and initiates HTTP/2 requests is at risk. The fix is supplied in Axios 1.20.0 and later.
Risk and Exploitability
The CVSS score of 8.2 denotes a high severity DoS vulnerability, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker forcing the application to create or reuse an HTTP/2 session that triggers a ClientHttp2Session error—such as by sending a crafted HTTP/2 request or by exploiting an endpoint that internally uses Axios for downstream calls. Because the unhandled error can terminate the entire process, an attacker who can influence the request flow can interrupt service availability.
Github GHSA