Description
Axios shouldBypassProxy() normalizes hostnames with hostname.replace(/\.+$/, ''). For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.15.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets - CVE-2026-86472
- Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - CVE-2026-44496
- fast-uri vulnerable to host confusion via percent-encoded scheme normalization - CVE-2026-76172
- SvelteKit: URL redirection to untrusted site via enhanced form submission - CVE-2026-114060
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026