Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-101901, describes a Denial of Service (DoS) in Axios when using Node.js HTTP/2 support. Specifically, it states that Http2Sessions.getSession() creates a ClientHttp2Session but only registers a 'close' handler, neglecting to register an 'error' handler. This leads to an uncaught exception and process termination if the session emits an 'error' event.
I began by fetching the commit information for the provided patch URL: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a. The commit message, 'fix: harden runtime option handling (#11141)', indicates a general hardening effort, but the specific changes within the files are crucial.
Upon reviewing the diff, the most relevant change directly addressing the described vulnerability is found in lib/helpers/Http2Sessions.js. The patch clearly shows the addition of the line session.once('error', removeSession); within the getSession method. This addition directly remedies the missing error handling that was the root cause of the DoS vulnerability.
Therefore, the Http2Sessions.getSession function is identified as the vulnerable function because, in the versions prior to this patch, it lacked the necessary error handling for ClientHttp2Session objects, making the application susceptible to process crashes when HTTP/2 session errors occurred. The other changes in the commit, while part of a broader hardening effort, address different issues (e.g., prototype pollution, proxy bypass logic, data URI validation) and are not directly related to this specific HTTP/2 DoS vulnerability.
Http2Sessions.getSessionlib/helpers/Http2Sessions.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | >= 1.13.0, < 1.20.0 | 1.20.0 |