CVE-2026-39865: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39865 is a Denial of Service vulnerability in the Axios HTTP client library, specifically affecting its HTTP/2 session cleanup logic. The flaw exists in versions >= 1.13.0 and < 1.13.2, where a state corruption bug in the Http2Sessions.getSession() method allows a malicious server to crash the client process through concurrent session closures. It was published on April 8, 2026, with a fix released in version 1.13.2. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is a control flow error in the Http2Sessions.getSession() method within lib/adapters/http.js, classified under CWE-400 (Uncontrolled Resource Consumption), CWE-662 (Improper Synchronization), and CWE-367 (TOCTOU Race Condition). In the vulnerable code, after calling entries.splice(i, 1) to remove a session from the sessions array, the loop continues iterating over the now-modified array when more than one entry exists — accessing shifted or invalid indices and causing undefined behavior. The fix restructures the control flow to return immediately after any session removal, preventing further iteration over a mutated array. Exploitation requires the client to have HTTP/2 enabled and to connect to an attacker-controlled server that can close multiple concurrent sessions simultaneously with precise timing (Github Advisory, Axios Release).

Successful exploitation results in a complete crash of the affected Node.js client process, causing full loss of availability for that process. There is no confidentiality or integrity impact — the vulnerability does not enable information disclosure or data modification. The scope is limited to the single client process making HTTP/2 requests; it does not propagate to other system components. While the service may auto-restart, repeated exploitation could cause persistent disruption to applications relying on axios for HTTP/2 communication, including IBM products such as App Connect Enterprise, MQ Operator, API Connect, SPSS Collaboration and Deployment Services, and watsonx Orchestrate (Github Advisory, IBM Advisory).

A proof-of-concept (PoC) exploit is publicly documented in the GitHub Security Advisory, describing a step-by-step method to reproduce the crash using a malicious HTTP/2 server. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.021% per GitHub Advisory), placing it in a low exploitation probability tier. No specific threat actor attribution has been reported (Github Advisory).

1. Set up a malicious HTTP/2 server: Deploy a server capable of accepting multiple concurrent HTTP/2 connections from an axios client and controlling the timing of session closures.
2. Lure the target client: Direct a vulnerable axios client (version >= 1.13.0, < 1.13.2 with HTTP/2 enabled) to connect to the attacker-controlled server — for example, via a redirect, SSRF, or by acting as a man-in-the-middle.
3. Establish multiple concurrent HTTP/2 sessions: Ensure the axios client opens multiple simultaneous HTTP/2 sessions to the malicious server (e.g., by serving responses that trigger additional connections).
4. Simultaneously close all sessions: Trigger the server to close all established HTTP/2 sessions at the same time with precise timing, initiating concurrent cleanup callbacks in the axios client.
5. Trigger state corruption: The flawed while (i--) loop in Http2Sessions.getSession() continues iterating after entries.splice(i, 1) modifies the array, causing access to invalid/shifted indices and resulting in a process crash (Denial of Service) (Github Advisory).

• Logs: Unexpected Node.js process crash logs or unhandled exception stack traces referencing lib/adapters/http.js or the Http2Sessions class; application restart events logged by process managers (e.g., PM2, systemd).
• Network: Unusual patterns of multiple concurrent HTTP/2 connections to a single external host followed by simultaneous session terminations; unexpected outbound HTTP/2 traffic to unfamiliar or untrusted servers.
• Process: Repeated unexpected termination and restart of Node.js processes running axios-based applications; crash dumps or core files generated by the Node.js runtime during HTTP/2 session handling.

The primary remediation is to upgrade axios to version 1.13.2 or later, which restructures the session cleanup control flow to prevent continued iteration over a modified array (Github Advisory, Axios Release). For applications unable to update immediately, consider disabling HTTP/2 support in axios or restricting outbound HTTP/2 connections to trusted, controlled servers only. IBM has released security bulletins for affected products including App Connect Enterprise, MQ Operator, API Connect, SPSS Collaboration and Deployment Services, and watsonx Orchestrate, and users of those products should apply the relevant IBM-provided fixes (IBM Advisory, IBM SPSS Advisory).

The vulnerability was reported by researcher vmulas and analyzed by sealonohana via the GitHub Security Advisory program, with the fix authored by the axios maintainer jasonsaayman. Red Hat tracked the issue via Bugzilla (Bug 2456538) and assessed it as medium severity. IBM issued multiple security bulletins across its product portfolio acknowledging the impact. Community reaction has been limited given the medium severity and narrow affected version range (1.13.0–1.13.1), with no significant social media controversy observed (Github Advisory, Red Hat Bugzilla).