Skip to main content

Axios EUVDEUVD-2026-36259

| CVE-2026-44496 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-04 https://github.com/axios/axios GHSA-hfxv-24rg-xrqf
Denial Of Service Node.js
7.5
CVSS 3.1 · Vendor: https://github.com/axios/axios
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify axios app with dynamic xsrfCookieName
  2. Delivery
    Find injection sink (prototype pollution or config input)
  3. Exploit
    Deliver malicious regex cookie name like (.+)+$
  4. Execution
    Axios calls cookies.read on next request
  5. Persist
    RegExp matches document.cookie with catastrophic backtracking
  6. Impact
    JavaScript event loop blocked, tab frozen

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires all of the following: (1) the target uses axios in a standard browser environment that invokes the XHR or fetch adapter (Node.js HTTP adapter, React Native, and web workers are NOT exploitable because they do not read document.cookie); (2) the application allows attacker-controlled data to flow into the xsrfCookieName axios config option, or directly into a call to the internal axios/unsafe/helpers/cookies.js helper - typical sinks include prototype pollution of xsrfCookieName, configuration built from URL/query/profile input, or unsafe merging of user-supplied config; (3) the application has not set xsrfCookieName: null and is not using the default static 'XSRF-TOKEN' value as a non-attacker-controlled literal. Limiting factors: no exploitation against default configurations, no impact on server-side Node HTTP usage, and the result is availability-only (frozen tab) - no credential disclosure or request tampering.
Impact

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, unauthenticated availability-only impact, with no confidentiality or integrity exposure. However, real-world risk is materially lower than the score suggests because exploitation requires that attacker-controlled data actually reach the xsrfCookieName configuration - applications using the default static 'XSRF-TOKEN' value are unaffected, as are non-browser deployments. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit identified at time of analysis beyond the PoC embedded in the vendor advisory. The impact is a frozen browser tab rather than server compromise, so this is best treated as a hardening fix for browser-side axios consumers that accept dynamic XSRF configuration, not an emergency. CVSS vector marks AV:N, but practical exploitation depends on a specific configuration injection sink in the consuming application - verify with application-level threat modeling.
Exploit ScenarioDerived

An attacker identifies a single-page web application where the axios xsrfCookieName configuration is derived from a URL parameter, user profile field, or other input reachable via prototype pollution. The attacker supplies a malicious name such as (.+)+$ or (([^;])+)+\$ along with a moderately long cookie string; when axios prepares its next request and calls cookies.read(name) against document.cookie, the regex engine enters catastrophic backtracking and freezes the browser tab for seconds to minutes per attempt. A working PoC is included verbatim in the GHSA advisory.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 04, 2026

Client-side denial of service in Axios versions before 0.32.0 (0.x line) and before 1.16.0 (1.x line) allows attackers who influence the XSRF cookie name configuration to trigger catastrophic regex backtracking when axios reads document.cookie in browser environments. The flaw stems from unescaped interpolation of the cookie name into a dynamically constructed RegExp, and a detailed proof-of-concept is published in the GitHub Security Advisory, though no public exploitation has been observed in the wild.

RemediationAI

Vendor-released patch: upgrade axios to 1.16.0 (1.x users) or 0.32.0 (0.x users), per the release notes at https://github.com/axios/axios/releases/tag/v1.16.0 and https://github.com/axios/axios/releases/tag/v0.32.0; the fix replaces dynamic regex construction with string-based splitting on ';' and exact name comparison. Note that 0.32.0 includes a breaking change - mergeConfig and header merging now return null-prototype objects, so consumers must use Object.prototype.hasOwnProperty.call(obj, key) when accessing merged config. If immediate upgrade is not possible, set xsrfCookieName: null in axios configuration to disable cookie reading entirely (trade-off: breaks any CSRF flow that relies on axios auto-attaching the XSRF token), keep the default static 'XSRF-TOKEN' value, never derive xsrfCookieName from untrusted input, and avoid direct calls to axios/unsafe/helpers/cookies.js with attacker-controlled names. If dynamic cookie names are unavoidable, enforce a strict allowlist of safe cookie-name characters (e.g., ^[A-Za-z0-9_-]+$) before passing the value to axios.

Affected VersionsENISA

axios 1.0.0, < 1.16.0
axios < 0.32.0

Affected Packages

npm axios fix: 0.32.0, 1.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Axios is a widely deployed npm HTTP client (pkg:npm/axios) used in browser and Node.js applications. The root cause is CWE-400 (Uncontrolled Resource Consumption) realized through CWE-1333 (Inefficient Regular Expression Complexity): lib/helpers/cookies.js builds a regex via new RegExp('(?:^|; )' + name + '=([^;]*)') without escaping regex metacharacters in name. When the cookie name contains nested quantifiers such as (.+)+$, matching against document.cookie triggers exponential backtracking. The vulnerable path is reached from lib/helpers/resolveConfig.js in 1.x and lib/adapters/xhr.js in 0.x when browser XHR/fetch adapters resolve XSRF config, or by direct callers of axios/unsafe/helpers/cookies.js. Node HTTP adapter usage, React Native, and web workers do not invoke document.cookie and are therefore unaffected.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/axios/axios) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (https://github.com/axios/axios).

CVSS VectorVendor: https://github.com/axios/axios

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Summary

Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie.

The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie.

Impact

Applications are affected only when attacker-controlled data can reach the XSRF cookie name configuration or a direct/unsafe call to the internal cookie helper.

This does not expose credentials, modify requests, or affect response integrity. The impact is availability only.

Affected Functionality

Affected code paths:

  • lib/helpers/cookies.js read(name) in standard browser environments.
  • lib/helpers/resolveConfig.js in 1.x, when browser XHR/fetch adapters resolve XSRF config.
  • lib/adapters/xhr.js in 0.x, when the XHR adapter reads the configured XSRF cookie.
  • Direct use of axios/unsafe/helpers/cookies.js in 1.x, if callers pass attacker-controlled names.

Unaffected code paths:

  • Default static xsrfCookieName: 'XSRF-TOKEN' when not attacker-controlled.
  • Requests with xsrfCookieName: null.
  • Node HTTP adapter usage without browser document.cookie.
  • React Native and web workers where axios does not use standard browser cookie access.

Technical Details

Affected versions interpolate the cookie name into a regex.

js
const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));

Because name is not escaped, regex metacharacters in the cookie name are interpreted as regex syntax. A payload such as (.+)+$ can force catastrophic backtracking against document.cookie.

The fix avoids dynamic regex construction and parses document.cookie by splitting on ;, trimming leading whitespace, and comparing cookie names with exact string equality.

Proof of Concept of Attack

js
function vulnerableRead(name, cookie) {
  const start = Date.now();

  try {
    cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
  } catch {}

  return Date.now() - start;
}

for (const n of [20, 22, 24, 26, 28]) {
  const cookie = 'x='.padEnd(n, 'a') + '!';
  console.log(`${n}: ${vulnerableRead('(.+)+$', cookie)}ms`);
}

Expected result: timings grow rapidly as the cookie string length increases.

Workarounds

Set xsrfCookieName: null if the application does not need axios to read an XSRF cookie.

Do not derive xsrfCookieName from untrusted input. If a dynamic cookie name is unavoidable, validate it against a strict cookie-name allowlist before passing it to axios.

Avoid calling axios/unsafe/helpers/cookies.js directly with untrusted names

<details> <summary>Original Source</summary>

Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

1. Title

ReDoS via Unsanitized Cookie Name in Dynamic Regular Expression Construction

2. Affected Software and Version

  • Software: Axios
  • Version: 1.15.0 (and potentially earlier versions)
  • Component: lib/helpers/cookies.js
  • Ecosystem: npm (Node.js / Browser)

3. Vulnerability Type / CWE

  • Type: Regular Expression Denial of Service (ReDoS)
  • CWE-1333: Inefficient Regular Expression Complexity
  • CWE-400: Uncontrolled Resource Consumption

4. CVSS 3.1 Score

Score: 7.5 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

MetricValue
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh

5. Description

The cookies.read() function in lib/helpers/cookies.js constructs a regular expression dynamically using the name parameter without any sanitization or escaping of special regex characters. At line 33, the code passes the raw name value directly into new RegExp():

javascript
const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));

An attacker who can control or influence the cookie name parameter (e.g., via XSRF cookie name configuration, prototype pollution of xsrfCookieName, or any code path where user input reaches cookies.read()) can inject a malicious regex pattern that causes catastrophic backtracking, leading to a Denial of Service condition.

With a crafted input of approximately 20-30 characters, the regex engine can be forced to consume several seconds to minutes of CPU time, effectively freezing the JavaScript event loop.

6. Root Cause Analysis

File: lib/helpers/cookies.js Line: 33

javascript
read(name) {
  if (typeof document === 'undefined') return null;
  const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
  return match ? decodeURIComponent(match[1]) : null;
},

The vulnerability exists because:

  1. The name parameter is concatenated directly into a regex pattern without escaping special regex metacharacters.
  2. An attacker can inject regex constructs that create exponential backtracking scenarios.
  3. The (?:^|; ) prefix combined with an injected pattern like ((((.*)*)*)*)* creates nested quantifiers that cause catastrophic backtracking when the regex engine attempts to match against document.cookie.

The cookies.read() function is called from lib/helpers/resolveConfig.js at line 61:

javascript
const xsrfValue = xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName);

The xsrfCookieName value comes from the Axios configuration, which can be influenced by prototype pollution or direct configuration injection.

7. Proof of Concept

javascript
// poc_redos_cookie.js
// Simulates browser environment for testing

// Simulate document.cookie
globalThis.document = {
  cookie: 'session=abc; ' + 'a'.repeat(50)
};

// Replicate the vulnerable cookies.read() logic
function cookiesRead(name) {
  const match = document.cookie.match(new RegExp('(?:^|; )' + name + '=([^;]*)'));
  return match ? decodeURIComponent(match[1]) : null;
}

// Malicious cookie name that triggers catastrophic backtracking
// The pattern creates nested quantifiers: (a]|[a]|...)*)*
const maliciousName20 = '([^;]+)+$' + '\\|'.repeat(10);
const maliciousName = '(([^;])+)+\\$';  // nested quantifier pattern

console.log('=== ReDoS via Cookie Name Injection PoC ===');

// Test with increasing payload sizes
for (const len of [15, 20, 25]) {
  const payload = '(([^;])+)+' + 'X'.repeat(len);
  const start = Date.now();
  try {
    cookiesRead(payload);
  } catch (e) {
    // May throw on invalid regex, but valid evil patterns won't throw
  }
  const elapsed = Date.now() - start;
  console.log(`Payload length ${len}: ${elapsed}ms`);
}

// Demonstrating exponential growth with a simple nested quantifier
console.log('\n--- Exponential Backtracking Demo ---');
for (const n of [20, 22, 24, 26]) {
  const evilName = '(' + 'a'.repeat(1) + '+)+$';
  const testCookie = 'a'.repeat(n) + '!';  // non-matching trailer forces backtracking
  globalThis.document = { cookie: testCookie };
  const start = Date.now();
  try {
    cookiesRead(evilName);
  } catch(e) {}
  const elapsed = Date.now() - start;
  console.log(`Input length ${n}: ${elapsed}ms`);
}

8. PoC Output

=== ReDoS via Cookie Name Injection PoC ===
Payload length 20: 21ms (extrapolated: 30 chars = ~21,504ms)
Payload length 25: ~1,300ms
Payload length 30: ~323,675ms (5+ minutes)

--- Exponential Backtracking Demo ---
Input length 20: 21ms
Input length 22: 84ms
Input length 24: 336ms
Input length 26: 1,344ms

The exponential growth pattern is clearly visible: each additional 2 characters approximately quadruples the execution time.

9. Impact

  • Denial of Service (Client-side): In a browser environment, an attacker who can influence the XSRF cookie name configuration (e.g., via prototype pollution or configuration injection) can freeze the browser tab, blocking all UI interaction and JavaScript execution on the page.
  • Denial of Service (Server-side): In SSR (Server-Side Rendering) frameworks or Node.js applications that process cookies using this code path, the event loop will be blocked, causing the server to become unresponsive to all requests.
  • Event Loop Starvation: Since JavaScript is single-threaded, the ReDoS will block all pending asynchronous operations, timers, and I/O callbacks for the duration of the regex evaluation.

10. Remediation / Suggested Fix

Escape all regex metacharacters in the name parameter before constructing the regular expression.

javascript
// FIXED: lib/helpers/cookies.js

function escapeRegExp(string) {
  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

// ...

read(name) {
  if (typeof document === 'undefined') return null;
  const match = document.cookie.match(
    new RegExp('(?:^|; )' + escapeRegExp(name) + '=([^;]*)')
  );
  return match ? decodeURIComponent(match[1]) : null;
},

Alternatively, avoid dynamic regex construction entirely and use string-based parsing:

javascript
read(name) {
  if (typeof document === 'undefined') return null;
  const cookies = document.cookie.split('; ');
  for (const cookie of cookies) {
    const eqIndex = cookie.indexOf('=');
    if (eqIndex !== -1 && cookie.substring(0, eqIndex) === name) {
      return decodeURIComponent(cookie.substring(eqIndex + 1));
    }
  }
  return null;
},

11. References

</details>

---

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Executive ViewAI

Why It Matters

Axios, a widely-used HTTP client library, contains a client-side denial of service vulnerability (CVSS 7.5) with publicly available exploit code. Attackers controlling XSRF cookie configuration can trigger excessive resource consumption, causing application unavailability. Organizations face immediate risk of service disruption and user impact.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2024-35286 CRITICAL POC
9.8 Oct 21

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf ADVISORY https://vuldb.com/vuln/370407 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-44496 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:27044 REF https://access.redhat.com/errata/RHSA-2026:27063 REF https://access.redhat.com/errata/RHSA-2026:28571 REF https://access.redhat.com/errata/RHSA-2026:28964 REF https://access.redhat.com/errata/RHSA-2026:29082 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30076 REF https://access.redhat.com/errata/RHSA-2026:30650 REF https://access.redhat.com/errata/RHSA-2026:30651 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:33683 REF https://access.redhat.com/errata/RHSA-2026:34766 REF https://access.redhat.com/errata/RHSA-2026:36611 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:36883 REF https://access.redhat.com/errata/RHSA-2026:40119 REF https://access.redhat.com/errata/RHSA-2026:40138 REF https://access.redhat.com/errata/RHSA-2026:41055 REF https://access.redhat.com/errata/RHSA-2026:41064 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42085 REF https://access.redhat.com/errata/RHSA-2026:42142 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:46885 REF https://access.redhat.com/errata/RHSA-2026:46903 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:56789 REF https://access.redhat.com/errata/RHSA-2026:57191 REF https://access.redhat.com/errata/RHSA-2026:59360 REF https://access.redhat.com/errata/RHSA-2026:59833 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-44496 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487943 REF https://github.com/advisories/GHSA-hfxv-24rg-xrqf REF https://github.com/axios/axios/releases/tag/v0.32.0 REF https://github.com/axios/axios/releases/tag/v1.16.0 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44496.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy