Executive Summary

CVE-2026-44496 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Axios HTTP client library. It occurs because Axios versions before 0.32.0 (0.x line) and before 1.16.0 (1.x line) build a regular expression from the configured XSRF cookie name without escaping regex metacharacters.

An attacker who can influence the cookie name can inject malicious regex patterns that cause expensive regex backtracking when Axios reads document.cookie in standard browser environments. This leads to client-side availability issues such as freezing the browser tab while Axios prepares a request.

This vulnerability does not affect Node.js HTTP adapter usage, React Native, or web workers because Axios does not read document.cookie in those environments. The issue is fixed in Axios versions 0.32.0 and 1.16.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause severe client-side availability degradation by freezing the affected browser tab during Axios request preparation.

An attacker who can control the XSRF cookie name can trigger expensive regex backtracking, leading to denial of service on the client side.

It does not expose credentials or modify requests, but it can disrupt user experience by making the browser unresponsive.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as client-side availability degradation, such as freezing the affected browser tab when Axios prepares a request. Detection involves monitoring for unusual browser tab freezes or performance issues in applications using vulnerable Axios versions.

Since the issue arises from Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line, checking the Axios version used in your project is a primary detection step.

• Run a command to check the installed Axios version, for example: `npm list axios` or `yarn list axios`.
• In browser environments, monitor for browser tab freezes or high CPU usage when Axios makes requests involving cookies.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Axios to a fixed version: 0.32.0 or later on the 0.x line, or 1.16.0 or later on the 1.x line.

If upgrading immediately is not possible, avoid allowing attacker-controlled cookie names that could inject malicious regex patterns, or disable usage patterns where Axios reads `document.cookie`.

Monitor client-side application behavior for signs of freezing or performance degradation and consider implementing fallback or timeout mechanisms for Axios requests.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability causes client-side availability degradation, such as freezing the affected browser tab, but does not expose credentials or modify requests.

There is no information provided about any direct impact on compliance with common standards and regulations like GDPR or HIPAA.

Useful 0 Not Useful 0