CVE-2026-44496 Details

A denial-of-service vulnerability has been identified in Axios, a promise-based HTTP client for the browser and Node.js. This issue affects Axios versions prior to 0.32.0 on the 0.x line and prior to 1.16.0 on the 1.x line. The vulnerability arises because these versions construct a regular expression from the configured XSRF cookie name without properly escaping regex metacharacters. In standard browser environments, an attacker who can manipulate the cookie name sent to Axios can induce costly regex backtracking while Axios processes 'document.cookie'. The practical effect is a degradation of client-side availability, such as causing the affected browser tab to freeze while Axios prepares a request. This vulnerability does not impact typical Node.js HTTP adapter usage, React Native, or web workers, where Axios does not access 'document.cookie'.

Users can upgrade to Axios versions 0.32.0 or 1.16.0 or later, and set 'xsrfCookieName: null' if the application does not require Axios to read an XSRF cookie. Avoid deriving the XSRF cookie name from untrusted input, and if a dynamic name is necessary, validate it against a strict allowlist before using it with Axios.