Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3308 more potentially affected by CVE-2026-101903 via axios (>=1.16.1, <=1.19.0)

axios NPM version =1.16.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3308 more potentially affected by CVE-2026-101903 via axios (>=1.16.1, <=1.19.0)

axios NPM version =1.16.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...

EUVD-2026-88378

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS...

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101906 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

EUVD-2026-88383

Axios: ReDoS ON² in shouldBypassProxy host normalization, reachable via untrusted redirect Location...

GHSA-MGHH-PGCX-3JJJ Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101906 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

NPM: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

NPM: Axios: ReDoS ON² in shouldBypassProxy host normalization, reachable via untrusted redirect Location vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

GHSA-X97P-JQ2G-JP4F Axios: Prototype Pollution Gadget in axios toFormData Options

Summary Axios form serialization reads visitor, maxDepth, dots, indexes, metaTokens, and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and...

Axios: Prototype Pollution Gadget in axios toFormData Options

Summary Axios form serialization reads visitor, maxDepth, dots, indexes, metaTokens, and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1581 more potentially affected by CVE-2026-101909 via axios (>=0.28.0, <=0.33.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-101909 Source advisory: OSV:GHSA-X97P-JQ2G-JP4F...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +4152 more potentially affected by CVE-2026-101909 via axios (>=1.15.1, <=1.19.0)

axios NPM version =1.15.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =1.2.3 and mo...

EUVD-2026-88392

Axios: Prototype Pollution Gadget in axios toFormData Options...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1581 more potentially affected by CVE-2026-101909 via axios (>=0.28.0, <=0.33.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-101909 Source advisory: GHSA-X97P-JQ2G-JP4F...

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.34.0...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +4152 more potentially affected by CVE-2026-101909 via axios (>=1.15.1, <=1.19.0)

axios NPM version =1.15.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =1.2.3 and mo...

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy. The HTTP/2 path builds a session with...