CVE-2026-39865
Fixed in a distro release EPSS <1%CVSS 5.9
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.13.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kibana-7 | 7.17.29-r8 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r19 |
| Chainguard | langfuse-2 | 2.95.12-r19 |
| Chainguard | langfuse-2-worker | 2.95.12-r19 |
| Chainguard | langfuse-fips-2 | 2.95.12-r22 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r22 |
| Debian 12 | node-axios | no fix |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.13.2+dfsg-1 |
| Ubuntu 25.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r19 |