Axios, a widely used promise‑based HTTP client, contains a state corruption bug in its HTTP/2 session cleanup logic. The flaw, present in Axios versions prior to 1.13.2, corrupts the internal session array during concurrent session closures, causing the client process to crash. This results in a denial‑of‑service condition for any application using the affected library. The weakness is rooted in incorrect control‑flow handling when removing sessions, mapping to CWE‑367 (Uncontrolled Resource Consumption), CWE‑400 (Buffer Overflow), and CWE‑662 (Concurrent Access to a Shared Resource).

Any project that imports the "axios" package at a version earlier than 1.13.2, whether in browser or Node.js environments, is susceptible. The vulnerability is tied to the HTTP/2 adapter implementation and would be triggered when the client communicates with a server that closes sessions concurrently.

The CVSS score of 5.9 indicates moderate severity, reflecting the impact of a crash but no code execution. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower public exploitation momentum. An attacker can exploit this by acting as a malicious HTTP/2 server that initiates concurrent session closures; the vulnerability is thus remotely exploitable from the server side and does not require local access.