Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Description

Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 0.31.1

  >= 1.0.0, < 1.16.0**

• Patched version(s): **0.32.0

  1.16.0**

References

• GHSA-hfxv-24rg-xrqf
• CVE-2026-44496
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327
• cookiejar Regular Expression Denial of Service via Cookie.parse function - CVE-2022-25901
• tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923

You might also like:

How do hackers hack websites?

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

Tags:

npm

axios