Axios Disclosed 12 CVEs Fixed in 1.20.0: Sorting Them by Reachability

On 16 September 2026 the axios project published 12 security advisories, CVE-2026-101898 through CVE-2026-101909. Seven are rated High. All are fixed in axios 1.20.0, which had already been on npm since 26 August, and two that also affect the old 0.x line are fixed in 0.34.0, released on 16 September. The GitHub Advisory Database added the reviewed records on 30 September.

Axios is one of the most installed packages on npm, so this batch lit up dashboards everywhere. Read the "affected functionality" sections, though, and the 12 sort into a few groups that each need something specific to be true.

What's affected

Fixed versions: 1.20.0 for every advisory, plus 0.34.0 for CVE-2026-101909 and CVE-2026-101902 on the 0.x line. Each advisory has its own lower bound, from 1.0.0 to 1.17.0, so an older 1.x release is not affected by all of them.

Group 1: HTTP/2 adapter (opt-in). Both need httpVersion: 2 in the Node.js adapter.

• CVE-2026-101898 (High): the HTTP/2 path drops configured lookup, agent and proxy settings. If you rely on a custom DNS lookup or proxy to block SSRF, HTTP/2 requests skip it. From 1.13.0.
• CVE-2026-101901 (High): an unhandled error event on the HTTP/2 session can crash the process. From 1.13.0.

Group 2: fetch adapter.

• CVE-2026-101907 (High): the fetch adapter ignores maxRedirects: 0, so a redirect you meant to block is followed. The advisory says this applies when you use the fetch adapter explicitly "or because the runtime selects it." From 1.17.0.

Group 3: proxy environment variables.

• CVE-2026-101899 (Moderate): CIDR entries in NO_PROXY, such as 10.0.0.0/8 or 169.254.169.254/32, are not treated as ranges, so that traffic still goes through the proxy. From 1.15.0.
• CVE-2026-101906 (High): a regular expression in proxy bypass checks backtracks quadratically on hostnames made of many dots. A malicious server can trigger it with a crafted redirect Location. Needs NO_PROXY and redirects. From 1.15.0.

Group 4: untrusted URLs.

• CVE-2026-101903 (High): a malformed data: URL with many slashes and no comma blocks the event loop in the data: parser. Reachable when you pass user-supplied URLs to axios without rejecting data: schemes. From 1.16.1.

Group 5: prototype pollution gadgets. Six advisories (CVE-2026-101900, 101902, 101904, 101905, 101908, 101909) describe places where axios reads a property that could be inherited from a polluted Object.prototype. Every one of them says the same thing: "Axios does not create the prototype pollution source." They matter only if some other bug in the same process can already pollute the prototype. The most serious, CVE-2026-101905, can redirect Node HTTP requests at the socket layer through an inherited createConnection.

How to check if you're exposed

List every axios copy, including transitive ones pulled in by SDKs:

npm ls axios --all

Then search for the features each group needs:

# Group 1: HTTP/2
grep -rn "httpVersion" src/

# Group 2: fetch adapter and redirect limits
grep -rnE "adapter:\s*['\"]fetch|maxRedirects:\s*0" src/

# Group 3: proxy env vars in your deploy config
grep -rn "NO_PROXY\|no_proxy" deploy/ k8s/ .env* Dockerfile 2>/dev/null

# Group 4: user-supplied URLs passed to axios
grep -rnE "axios(\.get|\.request|\()\s*\(?\s*(req\.|request\.|body\.|params\.|url\b)" src/

Group 5 needs a different question: does anything in this process have a known prototype pollution bug? Check your other dependencies' advisories for "prototype pollution" before you rank these gadgets.

A typical backend that calls a handful of fixed APIs over HTTP/1.1, with no proxy and no user-supplied URLs, has very little reachable surface here. A link-preview service or webhook dispatcher that fetches arbitrary URLs through a corporate proxy may be reachable through groups 3 and 4.

What to do now

1. Upgrade to axios 1.20.0 or later, and to 0.34.0 if you still have 0.x copies. Use overrides in npm or resolutions in Yarn to lift transitive copies:

   {
     "overrides": {
       "axios": "^1.20.0"
     }
   }
   

2. Don't use maxRedirects: 0 as your only SSRF control. Resolve and validate the destination IP before the request, and block link-local, loopback and private ranges.

3. Write NO_PROXY entries as hostnames as well as CIDRs until every service is on 1.20.0.

4. Reject data: URLs at the boundary where you accept URLs from users.

5. Fix the pollution source, not just the gadget. If a dependency in the same process has an open prototype pollution advisory, that bug is the real priority.

Why it matters

The fix shipped three weeks before the advisories. Teams that kept axios current were protected before anyone knew there was something to patch. Teams that wait for a CVE to trigger an upgrade were exposed for the whole gap, plus whatever lag their scanner adds.

The batch also shows why counting CVEs is a poor measure of risk. Twelve IDs sounds alarming. For most services, the honest answer is that zero to two of them are reachable, and the way to find out is to check which features you actually use.

Try it yourself

Run npm ls axios --all on one service and note every version. Then run the four grep groups and mark each of the 12 CVEs as reachable, not reachable or "depends on another bug". You can also drop the package.json into gold.safeguard.sh/scan to see the advisories matched to your versions without uploading the file.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-3pq3-5fj3-cg6v: HTTP/2 adapter bypasses DNS lookup and proxy controls
• GHSA-542g-h47m-68v8: HTTP/2 session error DoS
• GHSA-r4gj-5m52-g5wh: fetch adapter ignores maxRedirects 0
• GHSA-44g4-m2mj-wpvx: CIDR NO_PROXY entries ignored
• GHSA-mghh-pgcx-3jjj: shouldBypassProxy ReDoS
• GHSA-c29m-xwm3-cm6r: data URL ReDoS
• GHSA-m8m8-qj5v-23w3: createConnection prototype pollution gadget
• GHSA-x97p-jq2g-jp4f: toFormData prototype pollution gadget
• GHSA-9fr6-4gfg-395g: default instance method gadget
• axios v1.20.0 release
• axios on npm