Most recent entries from all

fkie_cve-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.

GHSA-3pq3-5fj3-cg6v — Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Affected: npm: axios

## Summary

Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses `httpVersion: 2`. The HTTP/1 adapter path wraps and forwards `config.lookup`, builds normal request options, and applies proxy routing through `setProxy()`. The HTTP/2 path builds a session with `http2.connect()` using only `options.http2Options`, which drops the top-level `lookup`, `agent`, and proxy state.

Applications are affected when they allow a user to influence request destinations, enable axios HTTP/2, and rely on axios `lookup` or proxy routing to prevent SSRF or enforce outbound network policy.

## Impact

In affected server-side deployments, an attacker can cause axios to connect directly to destinations that the configured resolver or proxy would have rejected. Depending on reachable services, this can expose cloud metadata, internal service responses, or allow state-changing requests to internal systems.

This is not an unconditional SSRF in every axios deployment. It requires `httpVersion: 2` and an application-level trust boundary where user-influenced URLs are constrained by `lookup` or proxy policy.

## Affected Functionality

Affected:

- Node.js HTTP adapter with `httpVersion: 2`. - `config.lookup` supplied as a DNS policy. - Explicit `config.proxy` and environment-derived proxy settings for HTTPS HTTP/2 requests.

Not affected:

- Browser adapters. - Node HTTP/1 requests, which pass `lookup` to the transport and apply proxy handling. - Applications t…

RHSA-2026:74869 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization axios: axios: Unintended HTTP method override via prototype pollution gadget axios: Axios: Denial of Service via malformed data URLs axios: Axios: HTTP header injection via inherited prototype properties axios: axios: Request socket hijacking via inherited createConnection property axios: axios: Denial of Service via crafted redirect hostname axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution axios: axios: Denial of Service via prototype pollution gadget in form serialization

UBUNTU-CVE-2026-101898

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios