axios : Server-Side Request Forgery (SSRF) Vulnerability - CVE-2026-101898 - Vulnerability Database

axios : Server-Side Request Forgery (SSRF) Vulnerability - CVE-2026-101898

Medium

Reference: CVE-2026-101898

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-101898

Title: axios : Server-Side Request Forgery (SSRF) Vulnerability

Overview:

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0 Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.c