Description
Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.16.1, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) - CVE-2026-116581
- Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
- Mermaid XY Charts are vulnerable to an infinite loop DoS - CVE-2026-71436
- Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking - CVE-2026-42033
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026