{"id":"EUVD-2026-88367","revision":"561a59af01bc4e2abd19dbc64a786579","records":[{"revision":"561a59af01bc4e2abd19dbc64a786579","observedAt":"2026-11-09T04:16:03.731+00:00","statement":{"source":"euvd","id":"EUVD-2026-88367","aliases":["CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"],"title":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 wi…","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7,"severity":null}],"references":["https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v","https://github.com/axios/axios/pull/11141","https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","https://github.com/axios/axios/releases/tag/v1.20.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88367","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 28, 2026, 5:10:16 PM","dateUpdated":"Sep 28, 2026, 5:50:05 PM"},"relatedAdvisories":[{"id":"RHSA-2026:74871","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-93450","CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"]},{"id":"RHSA-2026:74872","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"]},{"id":"RHSA-2026:74869","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-93981","CVE-2026-101898","CVE-2026-101900","CVE-2026-101901","CVE-2026-101902","CVE-2026-101903","CVE-2026-101904","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101908","CVE-2026-101909"]},{"id":"WID-SEC-W-2026-4056","title":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-101898","CVE-2026-101901","CVE-2026-101903","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101909","CVE-2026-12185","CVE-2026-12802","CVE-2026-12860","CVE-2026-13006","CVE-2026-13676","CVE-2026-14682","CVE-2026-18036","CVE-2026-19534","CVE-2026-19693","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-49434","CVE-2026-50750","CVE-2026-53404","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-55153","CVE-2026-55831","CVE-2026-55833","CVE-2026-56624","CVE-2026-56745","CVE-2026-58061","CVE-2026-58062","CVE-2026-59641","CVE-2026-59645","CVE-2026-59651","CVE-2026-59903","CVE-2026-62243","CVE-2026-65182","CVE-2026-65183","CVE-2026-65637","CVE-2026-65927","CVE-2026-66422","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-68495","CVE-2026-68497","CVE-2026-68498","CVE-2026-68525","CVE-2026-68569","CVE-2026-68763","CVE-2026-71888","CVE-2026-71889","CVE-2026-71891","CVE-2026-73086","CVE-2026-73507","CVE-2026-73508","CVE-2026-73634","CVE-2026-73635","CVE-2026-73646","CVE-2026-75140","CVE-2026-75595","CVE-2026-75596","CVE-2026-75975","CVE-2026-76172","CVE-2026-77185","CVE-2026-84292","CVE-2026-84375","CVE-2026-93488","CVE-2026-93491","CVE-2026-93558","CVE-2026-93690","CVE-2026-93748","CVE-2026-93994"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88367","identifiers":["EUVD-2026-88367","CVE-2026-101898","GHSA-3pq3-5fj3-cg6v"]},"retained":false,"historicalAffected":[]}],"coverage":[]}