CVE-2026-101906 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified as a Regular Expression Denial of Service, or ReDoS, affects Axios versions ranging from 1.15.0 to 1.20.0. Axios is widely utilized as a promise-based HTTP client for both browser environments and Node.js applications. The core issue resides within the logic governing proxy bypass mechanisms, specifically in how the library processes hostnames during redirect operations when specific environment variables are configured. When an application relies on Axios with HTTP_PROXY or HTTPS_PROXY environment variables set to direct traffic through a proxy server, and simultaneously has NO_PROXY or no_proxy defined to exclude certain domains from this routing, the library employs regular expressions to determine if a target hostname should bypass the proxy. This determination is critical for maintaining network performance and adhering to organizational security policies regarding internal versus external resource access.
The technical flaw stems from the implementation of the regex pattern used in the shouldBypassProxy function. The code utilizes a trailing-dot matching strategy that relies on a regular expression capable of quadratic backtracking when processing malformed input. Specifically, if an HTTP redirect response contains a Location header with a hostname featuring many consecutive dots followed by a non-dot character, the JavaScript engine's regex parser enters a state of catastrophic backtracking. This occurs because the pattern attempts to match various combinations of characters before failing and retrying different paths through the string. In synchronous execution contexts typical of Node.js event loop processing, this computational explosion consumes excessive CPU resources without yielding control back to the event loop.
The operational impact of this vulnerability is a severe denial of service condition for any application using the affected Axios versions under the described configuration conditions. Because JavaScript in Node.js operates on a single-threaded event loop, blocking it with intensive regular expression processing prevents the execution of all other asynchronous operations within that process. This includes handling incoming network requests, executing timers, and managing I/O operations. Consequently, an attacker who can control or influence HTTP redirect responses directed at vulnerable applications can trigger this behavior remotely. The result is a complete freeze of the application's responsiveness, effectively rendering it unavailable to legitimate users until the process crashes or is manually restarted by system administrators.
This vulnerability aligns with Common Weakness Enumeration CWE-133, which describes inefficient regular expression complexity leading to resource exhaustion. It also maps to MITRE ATT&CK techniques related to Denial of Service via application layer attacks, where adversaries exploit software logic flaws rather than network bandwidth limitations. The attack vector is remote and requires the victim application to follow redirects from a maliciously crafted server that returns Location headers with deeply nested dot sequences in the hostname field. This highlights the risk associated with trusting external HTTP responses without sufficient validation or length limits on hostnames before processing them through complex parsing logic.
Mitigation for this issue involves upgrading Axios to version 1.20.0 or later, where the regular expression has been optimized to prevent quadratic backtracking and ensure linear time complexity during hostname evaluation. For organizations unable to upgrade immediately due to dependency constraints, implementing a reverse proxy such as Nginx in front of Node.js applications can provide an additional layer of defense by sanitizing HTTP headers before they reach the application server. Additionally, developers should review their code for any custom regular expressions handling user-controlled input and apply principles like atomic grouping or possessive quantifiers to prevent backtracking vulnerabilities. Monitoring system metrics for unusual CPU spikes correlated with specific API endpoints may also help in detecting active exploitation attempts of this flaw in production environments.