Detections
Analytics
SCA: security update for axios (GHSA-qj83-cq47-w5f8)
medium Tenable Self-Hosted Container Security Plugin ID 440060
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to
1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server
to crash the client process through concurrent session closures. The vulnerability exists in the
Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control
flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
(CVE-2026-39865)
Solution
Update the axios library and its related packages to version 1.13.2 or later.See Also
Plugin Details
Severity: Medium
ID: 440060
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 4/8/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.2
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-39865
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/8/2026
Vulnerability Publication Date: 4/8/2026
Reference Information
CVE: CVE-2026-39865
cwe: CWE-400