Description
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
CVSS 5.9EPSS 0.731%Risque 0.63
Voir la source- Publication
- 2026-04-08 15:16:16
- Versions concernées
- <1.13.2
- Type
- Package
- Dernière modification
- 2026-07-24 21:10:00
- Vecteur
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H