{"id":"EUVD-2026-88367","enisaUuid":"0bbc07f9-719b-31ee-9943-9935389d9f88","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","datePublished":"Sep 28, 2026, 5:10:16 PM","dateUpdated":"Sep 28, 2026, 5:50:05 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v\nhttps://github.com/axios/axios/pull/11141\nhttps://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a\nhttps://github.com/axios/axios/releases/tag/v1.20.0\n","aliases":"CVE-2026-101898\nGHSA-3pq3-5fj3-cg6v\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"30043ffb-61a8-3b92-9e4c-313a68ee3f7f","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"1.13.0, \u003c 1.20.0"}],"enisaIdVendor":[{"id":"10bb43b3-be45-3853-ac29-d0aad17bed0f","vendor":{"name":"axios"}}],"enisaIdVulnerability":[{"id":"6451b352-f71b-3557-bd0e-e950f4cfb0ee","vulnerability":{"id":"GHSA-3pq3-5fj3-cg6v","description":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","datePublished":"Sep 30, 2026, 3:02:14 PM","dateUpdated":"Sep 30, 2026, 3:02:14 PM","baseScore":0.0,"references":"https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101898\nhttps://github.com/axios/axios/pull/11141\nhttps://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a\nhttps://github.com/axios/axios\nhttps://github.com/axios/axios/releases/tag/v1.20.0\n","enisa_id":"EUVD-2026-88367\n","aliases":"GHSA-3pq3-5fj3-cg6v\nCVE-2026-101898\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7dd3670d-95b5-3d7b-93f9-1866ae2578f6","vulnerability":{"id":"CVE-2026-101898","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","datePublished":"Sep 28, 2026, 5:10:16 PM","dateUpdated":"Sep 28, 2026, 5:50:05 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v\nhttps://github.com/axios/axios/pull/11141\nhttps://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a\nhttps://github.com/axios/axios/releases/tag/v1.20.0\n","enisa_id":"EUVD-2026-88367\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 8, 2026, 7:15:30 AM","vulnerabilityProduct":[{"id":"24f61228-2029-32ac-a32e-dc452f67b9e5","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"1.13.0, \u003c 1.20.0"}],"vulnerabilityVendor":[{"id":"93dfddcf-a179-346c-b784-142df4e53778","vendor":{"name":"axios"}}]}}],"enisaIdAdvisory":[{"id":"425a7a42-b161-3006-a4c0-554ddc8c12d1","advisory":{"id":"RHSA-2026:74871","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 2, 2026, 10:22:42 AM","dateUpdated":"Oct 31, 2026, 8:10:15 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74871\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74871.json\n","aliases":"CVE-2026-93450\nCVE-2026-101898\nCVE-2026-101900\nCVE-2026-101901\nCVE-2026-101902\nCVE-2026-101903\nCVE-2026-101904\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101908\nCVE-2026-101909\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"32a0bc42-c51d-3255-b127-90a5d8f2f74c","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a8a45be7-b3a0-392e-a414-9600451710ea","product":{"name":"grafana12.4-0:12.4.12-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c60b5051-df3c-3814-ae79-08b8d0830dfc","product":{"name":"grafana12.4-0:12.4.12-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"c765192b-1a6d-3c0f-ae33-119949a1bf10","product":{"name":"grafana12.4-0:12.4.12-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"67e5110e-f145-3501-b927-76f759be20b7","advisory":{"id":"RHSA-2026:74872","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 2, 2026, 10:28:50 AM","dateUpdated":"Oct 31, 2026, 8:10:15 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74872\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74872.json\n","aliases":"CVE-2026-101898\nCVE-2026-101900\nCVE-2026-101901\nCVE-2026-101902\nCVE-2026-101903\nCVE-2026-101904\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101908\nCVE-2026-101909\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"5677a6f4-0876-3190-9eb3-bf33ae3ed729","product":{"name":"grafana13.2-0:13.2.1-0.9.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"5d0d3bcc-7c6f-31d5-a26e-c85fe4fbcfa0","product":{"name":"grafana13.2-0:13.2.1-0.9.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"8404d7c1-0658-3a75-9e99-bd5e7ef152b6","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"e99cd7f5-4cbb-3160-a1b4-5f027fdf7f41","product":{"name":"grafana13.2-0:13.2.1-0.9.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"aa182c43-5330-33d2-977b-5c53ec6fd4da","advisory":{"id":"RHSA-2026:74869","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 2, 2026, 10:17:34 AM","dateUpdated":"Nov 7, 2026, 5:52:04 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74869\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74869.json\n","aliases":"CVE-2026-93981\nCVE-2026-101898\nCVE-2026-101900\nCVE-2026-101901\nCVE-2026-101902\nCVE-2026-101903\nCVE-2026-101904\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101908\nCVE-2026-101909\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"309bb809-5a04-31b0-bacc-1c5bdb079d1a","product":{"name":"grafana13.1-0:13.1.6-0.6.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"411112a7-0a4f-3960-8a84-c3c16d006628","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a38b8c33-91ea-3e0b-a2e8-6cb0efb50ea1","product":{"name":"grafana13.1-0:13.1.6-0.6.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c2720006-1a98-3e01-8239-007a59ba305c","product":{"name":"grafana13.1-0:13.1.6-0.6.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"e4b2f674-3d41-38ba-90c6-59ae49d545b2","advisory":{"id":"WID-SEC-W-2026-4056","description":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira ausnutzen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.","datePublished":"Oct 20, 2026, 10:00:00 PM","dateUpdated":"Nov 1, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4056.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-4056\n","aliases":"CVE-2026-101898\nCVE-2026-101901\nCVE-2026-101903\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101909\nCVE-2026-12185\nCVE-2026-12802\nCVE-2026-12860\nCVE-2026-13006\nCVE-2026-13676\nCVE-2026-14682\nCVE-2026-18036\nCVE-2026-19534\nCVE-2026-19693\nCVE-2026-41842\nCVE-2026-41845\nCVE-2026-41850\nCVE-2026-49434\nCVE-2026-50750\nCVE-2026-53404\nCVE-2026-54399\nCVE-2026-54428\nCVE-2026-54512\nCVE-2026-54513\nCVE-2026-55153\nCVE-2026-55831\nCVE-2026-55833\nCVE-2026-56624\nCVE-2026-56745\nCVE-2026-58061\nCVE-2026-58062\nCVE-2026-59641\nCVE-2026-59645\nCVE-2026-59651\nCVE-2026-59903\nCVE-2026-62243\nCVE-2026-65182\nCVE-2026-65183\nCVE-2026-65637\nCVE-2026-65927\nCVE-2026-66422\nCVE-2026-67213\nCVE-2026-67214\nCVE-2026-68494\nCVE-2026-68495\nCVE-2026-68497\nCVE-2026-68498\nCVE-2026-68525\nCVE-2026-68569\nCVE-2026-68763\nCVE-2026-71888\nCVE-2026-71889\nCVE-2026-71891\nCVE-2026-73086\nCVE-2026-73507\nCVE-2026-73508\nCVE-2026-73634\nCVE-2026-73635\nCVE-2026-73646\nCVE-2026-75140\nCVE-2026-75595\nCVE-2026-75596\nCVE-2026-75975\nCVE-2026-76172\nCVE-2026-77185\nCVE-2026-84292\nCVE-2026-84375\nCVE-2026-93488\nCVE-2026-93491\nCVE-2026-93558\nCVE-2026-93690\nCVE-2026-93748\nCVE-2026-93994\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"00d84633-d780-3bb9-a97b-70b5cf7f2246","product":{"name":"11.0.0","vendor":{"name":"Apache"}}},{"id":"08b51459-521c-306b-8770-a15440ede21f","product":{"name":"LTS 10.2.19","vendor":{"name":"Atlassian"}}},{"id":"0bba81f1-683d-343c-9cc3-c86a3b2c1c32","product":{"name":"Fisheye","vendor":{"name":"Atlassian"}}},{"id":"11eaf40e-60fc-3acc-b9b9-ba95aec5413c","product":{"name":"Confluence","vendor":{"name":"Atlassian"}}},{"id":"143722e9-cd64-36e0-8a93-3595418df424","product":{"name":"10.5.1","vendor":{"name":"Atlassian"}}},{"id":"19d80257-4cdd-32cf-a8b6-6520de3bacc3","product":{"name":"LTS 9.2.26","vendor":{"name":"Atlassian"}}},{"id":"19fd4f30-fe93-3fe4-92f3-866997ca66eb","product":{"name":"RESF Rocky Linux","vendor":{"name":"RESF"}}},{"id":"28813825-1f38-3580-95e9-87393633d6f1","product":{"name":"LTS 10.3.26","vendor":{"name":"Atlassian"}}},{"id":"292a8ff1-4d3a-3ca3-98f0-aff677be1e15","product":{"name":"Bamboo","vendor":{"name":"Atlassian"}}},{"id":"32718a5c-5e4d-319a-bb59-ed95c5ed7d3c","product":{"name":"bitbucket","vendor":{"name":"Atlassian"}}},{"id":"471381ed-0a13-3566-b1d2-304400d6b5ae","product":{"name":"LTS 10.2.24","vendor":{"name":"Atlassian"}}},{"id":"664336e0-d9b2-34a7-ae03-91bf7b076f68","product":{"name":"Crucible","vendor":{"name":"Atlassian"}}},{"id":"7e13d477-c185-3910-954b-f1b0d38d007c","product":{"name":"Jira","vendor":{"name":"Atlassian"}}},{"id":"92bc6a4d-1c6f-3d14-adf3-07cb65279b8d","product":{"name":"LTS 9.4.26","vendor":{"name":"Atlassian"}}},{"id":"a3ab47f1-8718-312a-b803-020ad7a37593","product":{"name":"LTS 10.2.8","vendor":{"name":"Atlassian"}}},{"id":"b8962931-805c-3345-90b2-b5a56f1ef791","product":{"name":"IBM License Metric Tool","vendor":{"name":"IBM"}}},{"id":"c547b450-980f-37e9-9cf8-62541df2dd18","product":{"name":"LTS 12.1.12","vendor":{"name":"Atlassian"}}},{"id":"c821e30e-21d0-3ae2-b84c-97c2413b257e","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"dece851b-a396-3ea7-9714-54d826ead194","product":{"name":"4.9.15","vendor":{"name":"Atlassian"}}},{"id":"eaf4f300-6972-314d-b137-670fd0b6ffab","product":{"name":"Oracle Linux","vendor":{"name":"Oracle Corporation"}}},{"id":"f7fbc05a-3d49-3bdc-8f78-c609b3197d7e","product":{"name":"LTS 11.3.12","vendor":{"name":"Atlassian"}}}]}}]}