CVE-2026-101901 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898

The Axios promise-based HTTP client for the browser and Node.js is vulnerable in versions 1.13.0 through 1.20.0 . The HTTP/2 adapter fails to consistently apply configured proxy settings or caller-supplied DNS lookup policies during request setup. Specifically, an HTTPS request using httpVersion:...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

K000163436: Apache Tomcat vulnerabilities CVE-2026-73581, CVE-2026-76183, CVE-2026-77762, and CVE-2026-79677

Security Advisory Description CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M...

CVE-2026-78437

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability allows a remote attacker to send a malformed HTTP/2 request. This can potentially cause a denial of service, leading to one request from another user failing...

CVE-2026-86350

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security...

CLSA-2026-1790611493 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 1.17.3-tuxcare.2...

CLSA-2026-1790611463 TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 1.24.0-tuxcare.2...

CLSA-2026-1790609840 TuxCare security update for nanoid (4 CVEs)

TuxCare rebuilt nanoid to address 4 CVEs. Fixed in 3.3.7-tuxcare.2...

CLSA-2026-1790609063 TuxCare security update for multer (1 CVE)

TuxCare rebuilt multer to address 1 CVE. Fixed in 1.4.5-lts.2-tuxcare.6...

CLSA-2026-1790606671 TuxCare security update for devalue (2 CVEs)

TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.1-tuxcare.2...

CLSA-2026-1790605435 TuxCare security update for devalue (2 CVEs)

TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.0-tuxcare.2...

CLSA-2026-1790602996 TuxCare security update for log4j:log4j (1 CVE)

TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.12-tuxcare.2...

Uncontrolled Resource Consumption

Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to an allocation leak in HTTP/2 backlog tracking when streams are reset, which allows a remote attacker to repeatedly reset streams and consume server resources, potentially causing denial of service...

CLSA-2026-1790597988 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.3.0-tuxcare.2...

CVE-2026-92103

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decodenext/2 in lib/mint/http2/frame.ex compares ...