Axios version 1.13.0‑1.13.1 contains a control flow bug in the HTTP/2 session cleanup code. When a malicious server triggers concurrent session closures, the client can corrupt internal state and crash, resulting in denial of service. The weakness involves improper handling of the sessions array, potentially leading to invalid memory access. This aligns with the weaknesses identified by CWE‑367, CWE‑400 and CWE‑662.

The affected product is Axios, the promise‑based HTTP client for browsers and Node.js, with vendors axios:axios. Affected versions are 1.13.0 through 1.13.1, inclusive. Versions 1.13.2 and later are not vulnerable.

The vulnerability receives a CVSS score of 5.9, indicating moderate severity. The EPSS score is below 1 %, and the flaw is not listed in the CISA KEV catalog, implying that widespread exploitation is currently unlikely. The likely attack vector is a malicious server that initiates HTTP/2 requests causing concurrent session cleanup; triggering this vulnerability would require the client to establish multiple connections with a server that intentionally closes sessions in parallel. While the conditions for exploitation are specific, a crash can interrupt services and potentially lead to broader denial‑of‑service scenarios if the client is critical to application availability.