CVE-2026-101903: Axios HTTP Client ReDoS DOS Vulnerability

CVE-2026-101903 Overview

CVE-2026-101903 is a regular expression denial of service (ReDoS) vulnerability in Axios, a promise-based HTTP client for browsers and Node.js. The flaw affects versions from 1.16.1 up to but not including 1.20.0. The DATA_URL_PATTERN regular expression used by the fromDataURI function permits slash characters on both sides of the media-type separator. When an attacker supplies a malformed data: URL containing many slashes and no comma, the JavaScript regex engine performs excessive backtracking. This synchronous work blocks the Node.js event loop and prevents the application from serving legitimate requests.

Critical Impact

A single attacker-controlled data URL can stall the Node.js event loop, causing a full application-level denial of service for any service that forwards untrusted URLs into Axios.

Affected Products

• Axios versions 1.16.1 through 1.19.x
• Node.js applications using axios.fromDataURI with attacker-controlled input
• Browser applications passing untrusted data: URLs to Axios

Discovery Timeline

• 2026-09-28 - CVE-2026-101903 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101903

Vulnerability Analysis

The vulnerability is classified as [CWE-1333] Inefficient Regular Expression Complexity. The DATA_URL_PATTERN regex used to parse RFC 2397 data URLs allows the / character on both sides of the media-type separator. When Axios receives a data URL that lacks a terminating comma but contains many slash characters, the regex engine attempts numerous separator placements before ultimately failing the match.

This parsing work runs synchronously on the Node.js single-threaded event loop. While backtracking proceeds, the process cannot handle incoming HTTP requests, timers, or I/O callbacks. Even a small volume of malicious inputs can render an Axios-dependent service unresponsive.

Root Cause

The affected identifiers are fromDataURI, DATA_URL_PATTERN, and the data: scheme handler. The regex permits ambiguity between the scheme prefix, the media type, and the base64 marker by tolerating repeated slashes. This ambiguity produces catastrophic backtracking on inputs that never match. The fix in version 1.20.0 hardens the pattern and related runtime option handling so that pathological inputs are rejected in linear time.

Attack Vector

An unauthenticated remote attacker submits a crafted data: URL to any endpoint or code path that eventually passes the URL to axios.fromDataURI. Common exposure points include image import features, webhook receivers, and proxy handlers that accept URLs from client input. No authentication or user interaction is required to trigger the backtracking. Repeated submissions amplify the impact and can be used to keep the event loop saturated.

// Security patch in lib/core/Axios.js - fix: harden runtime option handling (#11141)
// Method resolution now uses a safe property accessor to prevent
// prototype-pollution style manipulation of config values.
config.method = (
  utils.getSafeProp(config, 'method') ||
  utils.getSafeProp(this.defaults, 'method') ||
  'get'
).toLowerCase();

headers &&
  utils.forEach(
    ['delete', 'get', 'head', 'post', 'put', 'patch', 'query', 'common'],
    (method) => {
      delete headers[method];
    }
  );

config.headers = AxiosHeaders.concat(contextHeaders, headers);
// Source: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a

Detection Methods for CVE-2026-101903

Indicators of Compromise

• Inbound HTTP requests containing data: URLs with long runs of / characters and no , delimiter.
• Node.js worker processes showing sustained 100% single-core CPU usage without corresponding request throughput.
• Application response time spikes or health check failures that correlate with Axios usage.

Detection Strategies

• Perform a software composition analysis (SCA) scan for Axios releases in the range 1.16.1 to 1.19.x.
• Add web application firewall (WAF) rules that flag or block request parameters beginning with data: when they exceed a reasonable length or slash count.
• Instrument Axios call sites to log payloads passed to fromDataURI and reject inputs above a size threshold before parsing.

Monitoring Recommendations

• Alert on Node.js event loop lag metrics using tools such as perf_hooks.monitorEventLoopDelay.
• Correlate CPU saturation events with HTTP access logs to identify the offending request pattern.
• Track dependency drift for axios across services and fail builds that pin to unpatched versions.

How to Mitigate CVE-2026-101903

Immediate Actions Required

• Upgrade Axios to version 1.20.0 or later in all Node.js and browser bundles.
• Audit application code for calls to axios.fromDataURI or any handler that accepts data: URLs from untrusted sources.
• Deploy input length limits on request bodies and query parameters that may carry data URLs.

Patch Information

The issue is resolved in Axios 1.20.0. See the GitHub Security Advisory GHSA-c29m-xwm3-cm6r, the Axios Pull Request #11141, the remediation commit d19040b, and the Axios v1.20.0 release notes.

Workarounds

• Validate that any user-supplied data: URL contains a comma and has a bounded length before invoking Axios.
• Wrap fromDataURI calls in a timeout using AbortController or run parsing in a worker thread to protect the main event loop.
• Strip or reject data: scheme URLs at the ingress layer where the feature is not required.

# Upgrade Axios to the fixed release
npm install axios@^1.20.0

# Verify installed version across the workspace
npm ls axios

# Enforce a minimum version in package.json overrides for transitive deps
npm pkg set overrides.axios="^1.20.0"