Patch Forecast
Amber warning
Patch this week.

CVE-2026-101903 · GHSA-c29m-xwm3-cm6r

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Risk score
70/100
CVSS
8.2 v4.0
Exploit chance (30 days)
0.4%
Published
28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript re…
Affected
axios (npm) >= 1.16.1, < 1.20.0
Fix
Upgrade axios to 1.20.0 or later.
Exploitation
Public proof of concept

Story map

Story map: axiosTHE FLAWSTHE FIXCVE-2026-101903Axios: ReDoS in fromDataURIdata: URL parser freezes theNode event loop (DoS)CVSS 8.2 · EPSS 0%CVE-2026-101906Axios: ReDoS (O(N²)) inshouldBypassProxy hostnormalization, reachable via…CVSS 8.2 · EPSS 0%CVE-2026-101901Axios: Denial of Service viaUnhandled 'error' Event inHTTP/2 ClientHttp2Session…CVSS 8.2 · EPSS 0%CVE-2026-101909Axios: Prototype PollutionGadget in axios toFormDataOptionsCVSS 8.3 · EPSS 0%Upgrade axios1.20.0 · 0.34.0or later on your release lineWho is exposedaxios (npm) >= 1.15.0, < 1.20.0AMBER · PATCH THIS WEEKaxiosAxios is a promise-based HTTPclient for the browser andNode.js. From 1.15.0 until 1.20.0,Axios shouldBypassProxy appliesa quadratic trailing-dot regularexpression to redirecthostnames. HTTP_PROXY or…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-1333 (CWE-1333)42 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

axios: Amber, patch this week. Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Locat…

The flaws

  • CVE-2026-101903: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (CVSS 8.2 · EPSS 0%)
  • CVE-2026-101906: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (CVSS 8.2 · EPSS 0%)
  • CVE-2026-101901: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (CVSS 8.2 · EPSS 0%)
  • CVE-2026-101909: Axios: Prototype Pollution Gadget in axios toFormData Options (CVSS 8.3 · EPSS 0%)

The fix

Upgrade axios: 1.20.0 · 0.34.0 or later on your release line

Who is exposed: axios (npm) >= 1.15.0, < 1.20.0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 8.2 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
axiosnpm>= 1.16.1, < 1.20.01.20.0

References

Original description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.

Last activity 28 Sep 2026. Patch Forecast updates every hour.