Description
Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **<= 0.31.1 >= 1.0.0, < 1.16.0** Patched version(s): **0.32.0 1.16.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327
- cookiejar Regular Expression Denial of Service via Cookie.parse function - CVE-2022-25901
- tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
You might also like:
See something that needs correcting? Let us knowUpdated June 11, 2026