CVE-2026-101906
Received Received - Intake

Axios HTTP Proxy Redirect Quadratic ReDoS Vulnerability

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101906
EUVD
EUVD-2026-88383

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
axios axios From 1.15.0 (inc) to 1.20.0 (inc)
axios axios 1.20.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101906 is a ReDoS vulnerability in the Axios library affecting versions 1.15.0 to 1.20.0. It occurs in the shouldBypassProxy function which uses a regular expression to normalize hostnames. The regex can cause quadratic backtracking for hostnames with many trailing dots followed by a non-dot character, leading to high CPU usage and event-loop starvation in Node.js applications.

Detection Guidance

To detect this vulnerability, check if your system uses Axios versions between 1.15.0 and 1.20.0. Run: npm list axios. If affected, monitor for high CPU usage during HTTP requests with redirects. Use tools like Wireshark to inspect redirect responses for hostnames with excessive trailing dots.

Impact Analysis

This vulnerability can cause denial of service by blocking the Node.js event loop for seconds per redirect. It requires specific conditions like using environment proxy variables with NO_PROXY set, following redirects, and a malicious server returning a crafted redirect. The impact is limited to availability, with no data exposure or remote code execution.

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service through event-loop starvation in Node.js applications. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged downtime could lead to non-compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade Axios to version 1.20.0 or later immediately. If upgrading is not possible, disable redirects by setting maxRedirects: 0 or avoid using HTTP_PROXY/HTTPS_PROXY with NO_PROXY set. Review proxy configurations to ensure they do not follow untrusted redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart