Skip to content
Heist/ feed
HighFix available

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Type: advisorySource: OSV1 source record

## Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses `httpVersion: 2`. The HTTP/1 adapter path wraps and forwards `config.lookup`, builds normal request options, and applies proxy routing through `setProxy()`. The HTTP/2 path builds a session with `http2.connect()` using only `options.http2Options`, which drops the top-level `lookup`, `agent`, and proxy state. Applications are affected when they allow a user to influence request destinations, enable axios HTTP/2, and rely on axios `lookup` or proxy routing to prevent SSRF or enforce outbound network policy. ## Impact In affected server-side deployments, an attacker can cause axios to connect directly to destinations that the configured resolver or proxy would have rejected. Depending on reachable services, this can expose cloud metadata, internal service responses, or allow state-changing requests to internal systems. This is not an unconditional SSRF in every axios deployment. It requires `httpVersion: 2` and an application-level trust boundary where user-influenced URLs are constrained by `lookup` or proxy policy. ## Affected Functionality Affected: - Node.js HTTP adapter with `httpVersion: 2`. - `config.lookup` supplied as a DNS policy. - Explicit `config.proxy` and environment-derived proxy settings for HTTPS HTTP/2 requests. Not affected: - Browser adapters. - Node HTTP/1 requests, which pass `lookup` to the transport and apply proxy handling. - Applications that validat

Announced Source revision 1
Original source ↗

GHSA-3pq3-5fj3-cg6v

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-3pq3-5fj3-cg6v

axios

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.20.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.13.0"
          },
          {
            "fixed": "1.20.0"
          }
        ]
      }
    ],
    "package": {
      "name": "axios",
      "purl": "pkg:npm/axios",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3pq3-5fj3-cg6v/GHSA-3pq3-5fj3-cg6v.json"
    }
  }
]
Related CVEs
CVE-2026-101898

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-101898 · High

axios

Event
#37696 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement