CVE-2026-101906: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Axiosto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Affected deployments use Axios versions from 1.15.0 up to, but not including, 1.20.0, run in Node.js, have HTTP_PROXY or HTTPS_PROXY configured, have a non-empty NO_PROXY or no_proxy setting, and follow redirects.
What attacker-controlled input is required to trigger the issue?
An attacker needs to cause Axios to follow a redirect whose Location contains a hostname with many dots followed by a non-dot character. Processing that redirect hostname can cause synchronous quadratic regular-expression backtracking and block the Node.js event loop.
How can I determine whether an application may be affected?
Check whether the application uses an affected Axios version and whether its runtime environment sets HTTP_PROXY or HTTPS_PROXY together with a non-empty NO_PROXY or no_proxy value. Also determine whether requests can follow redirects to attacker-influenced Location headers.
What is the remediation?
Upgrade Axios to version 1.20.0, which fixes the issue. If upgrading cannot happen immediately, avoid following redirects to untrusted destinations where possible and review proxy and NO_PROXY/no_proxy environment configuration.