Regex Vulnerability in Axios HTTP Client Affects Multiple Versions
CVE-2026-44496
7.5HIGH
What is CVE-2026-44496?
The Axios HTTP client has a vulnerability where specific versions (0.x before 0.32.0 and 1.x before 1.16.0) do not properly escape regex metacharacters when constructing a regular expression from the configured XSRF cookie name. An attacker who can manipulate the cookie name can trigger excessive regex backtracking while Axios processes document.cookie, potentially leading to significant degradation of client-side availability. This may manifest as freezing or slow responsiveness of the affected browser tab. Notably, this issue does not impact the standard usage of Axios in Node.js environments, React Native, or web workers.
Affected Version(s)
axios >= 1.0.0, < 1.16.0 < 1.0.0, 1.16.0
axios < 0.32.0 < 0.32.0