Skip to main content

Axios CVE-2026-101906

| EUVDEUVD-2026-88383 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-09-28 GitHub_M GHSA-mghh-pgcx-3jjj
Denial Of Service Node.js Axios JavaScript npm
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network-reachable but AC:H because the attacker must control a redirect target and craft a backtracking hostname under a specific proxy/NO_PROXY/redirect config; impact is availability-only (event-loop DoS).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
POC Analysis Generated
Sep 28, 2026 - 19:23 vuln.today
Patch available
Sep 28, 2026 - 19:01 EUVD
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: JavaScript added
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: npm added
Analysis Generated
Sep 28, 2026 - 18:03 vuln.today
CVE Published
Sep 28, 2026 - 17:32 cve.org
HIGH 8.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 3,082 npm packages depend on axios (827 direct, 2,281 indirect)

Ecosystem-wide dependent count for version 1.15.0.

DescriptionCVE.org

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.

Articles & Coverage 1

News 15 New Node.js Vulnerabilities - 2 Critical, 13 High Severity Sep 29, 2026

AnalysisAI

Denial of service in the Axios HTTP client affects Node.js deployments running versions 1.15.0 through 1.19.x, where a crafted redirect Location hostname triggers quadratic regular-expression backtracking inside the proxy-bypass check and blocks the Node.js event loop. Successful exploitation requires an unusually specific combination - HTTP_PROXY/HTTPS_PROXY set, a non-empty NO_PROXY/no_proxy value, redirect following enabled, and requests reaching an attacker-influenced server that can return the malicious redirect - so exposure is narrow, and the reverse-trust nature of the attack means the adversary must control or compromise the redirect target rather than simply send a request to the victim. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a Node.js Axios deployment (browsers do not use the env-proxy path) that ALL of: has HTTP_PROXY or HTTPS_PROXY configured; has a non-empty NO_PROXY or no_proxy value (this is what invokes shouldBypassProxy); follows redirects (default maxRedirects>0); and issues a request that reaches an attacker-controlled or attacker-influenced server able to return a crafted redirect Location whose hostname is many dots followed by a non-dot character. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but narrowly-conditioned availability issue that scores high (vendor CVSS4 8.2) largely because CVSS 4.0's VA:H availability weighting inflates DoS findings; the AT:P (attack requirement present) metric already signals the exploit is not fire-and-forget. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade Axios to version 1.20.0, which rewrites the trailing-dot handling in shouldBypassProxy so it no longer backtracks quadratically; the fix is documented in advisory GHSA-mghh-pgcx-3jjj, the upstream pull request 11141, and the v1.20.0 release at https://github.com/axios/axios/releases/tag/v1.20.0 (commit d19040bda7a8be2f82c3c6e1a5bc03917daee39a). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Node.js applications using Axios versions 1.15.0 through 1.19.x and flag services that set HTTP_PROXY/HTTPS_PROXY, a non-empty NO_PROXY/no_proxy, and follow redirects; for those services, disable automatic redirect following (maxRedirects: 0) or block redirects to untrusted hosts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-101906 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy