CVE-2026-101906: Axios HTTP Client DoS Vulnerability

CVE-2026-101906 Overview

CVE-2026-101906 is a regular expression denial of service (ReDoS) vulnerability in Axios, a promise-based HTTP client for the browser and Node.js. The flaw affects versions 1.15.0 through 1.19.x and stems from a quadratic trailing-dot regular expression in the shouldBypassProxy function. Attackers can trigger catastrophic backtracking by crafting a redirect Location header containing many dots followed by a non-dot character. Synchronous regex processing blocks the Node.js event loop, causing denial of service on affected servers. The issue is fixed in Axios 1.20.0.

Critical Impact
Remote attackers can stall the Node.js event loop of any Axios client that follows redirects while HTTP_PROXY/HTTPS_PROXY and NO_PROXY are configured, producing sustained denial of service without authentication.

Affected Products

Axios versions 1.15.0 through 1.19.x (Node.js runtime)
Applications configured with HTTP_PROXY or HTTPS_PROXY and a non-empty NO_PROXY
Node.js services that follow HTTP redirects using Axios

Discovery Timeline

2026-09-28 - CVE-2026-101906 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101906

Vulnerability Analysis

The vulnerability resides in Axios proxy bypass logic. When resolving whether a redirect target matches the NO_PROXY list, shouldBypassProxy normalizes the hostname using hostname.replace(/\.+$/, ''). This trailing-dot regex exhibits quadratic backtracking against inputs composed of many dots followed by a non-dot character. Because Node.js executes regexes synchronously on the main thread, a single malicious response can monopolize the event loop and stall all concurrent requests. The weakness is classified as uncontrolled resource consumption [CWE-400].

Root Cause

The regular expression /\.+$/ is anchored only at the end of the string. When applied to a hostname such as "...........x", the engine repeatedly retries dot matches from every position before failing, producing quadratic time complexity relative to input length. Combined with unbounded hostname length from an attacker-controlled redirect, this yields a computable path to event-loop starvation.

Attack Vector

Exploitation requires the victim application to use Axios with proxy environment variables (HTTP_PROXY or HTTPS_PROXY), a non-empty NO_PROXY, and redirect following enabled. An attacker who controls or influences any URL fetched by the application returns an HTTP redirect (3xx) whose Location header contains a hostname crafted with many trailing dots. Axios processes the redirect, invokes shouldBypassProxy on the crafted hostname, and blocks the event loop.

javascript

// Security patch: harden runtime option handling (#11141)
// lib/adapters/fetch.js
const DEFAULT_CHUNK_SIZE = 64 * 1024;

const DEFAULT_REQUEST_OPTIONS = {
  cache: 'default',
  redirect: 'follow',
  referrer: 'about:client',
  referrerPolicy: '',
  mode: 'cors',
  integrity: '',
  keepalive: false,
  priority: 'auto',
  window: null,
};

const { isFunction } = utils;
// Source: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a

The accompanying change in lib/core/Axios.js uses utils.getSafeProp to prevent prototype-based option tampering that could reintroduce unsafe runtime paths:

javascript

// lib/core/Axios.js
config.method = (
  utils.getSafeProp(config, 'method') ||
  utils.getSafeProp(this.defaults, 'method') ||
  'get'
).toLowerCase();
// Source: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a

Detection Methods for CVE-2026-101906

Indicators of Compromise

Outbound HTTP responses containing Location headers with abnormally long hostnames dominated by dot characters.
Node.js processes showing sustained 100% CPU on a single thread coinciding with HTTP redirect activity.
Application logs indicating request timeouts, unresponsive /health endpoints, or event-loop lag spikes.

Detection Strategies

Perform software composition analysis to inventory all Node.js services using axios@>=1.15.0 <1.20.0.
Instrument the Node.js runtime with event-loop lag metrics (for example, perf_hooks.monitorEventLoopDelay) and alert on sustained delays over 500ms.
Inspect proxy environment configuration to identify services with HTTP_PROXY, HTTPS_PROXY, and NO_PROXY set, as these are the exploitable configuration.

Monitoring Recommendations

Log and review HTTP redirect responses handled by internal services, flagging Location headers whose hostname exceeds 253 characters or contains repeated . sequences.
Correlate CPU saturation alerts with outbound HTTP client activity in the AI SIEM to identify ReDoS behavior.
Enable request-duration histograms per upstream host to spot sudden latency inflation tied to specific redirect targets.

How to Mitigate CVE-2026-101906

Immediate Actions Required

Upgrade Axios to version 1.20.0 or later across all Node.js services and container images.
Audit dependency trees for transitive Axios usage using npm ls axios or equivalent tooling and rebuild affected artifacts.
If patching is not immediately feasible, disable automatic redirect following by setting maxRedirects: 0 on Axios request configurations.

Patch Information

The fix is delivered in Axios release v1.20.0 via Pull Request #11141 and commit d19040bd. Full advisory details are available in GHSA-mghh-pgcx-3jjj.

Workarounds

Unset NO_PROXY or clear HTTP_PROXY/HTTPS_PROXY for services that do not require outbound proxying, which disables the vulnerable code path.
Set maxRedirects: 0 on Axios instances to prevent processing of attacker-controlled Location headers.
Validate or truncate redirect target hostnames in an interceptor before Axios re-issues the request.

bash

# Upgrade Axios to the patched release
npm install axios@1.20.0 --save

# Verify installed version across the dependency tree
npm ls axios

# Temporary mitigation via Axios instance configuration
# axios.create({ maxRedirects: 0 })