CVE-2026-101906: Axios Denial of Service Vulnerability Due to ReDoS in Host Normalization
Summary
CVE-2026-101906: Axios shouldBypassProxy() normalizes hostnames with hostname.replace(/\.+$/, ''). Affects axios versions >= 1.15.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. Axios supports features such as interceptors, automatic JSON data transformation, and request cancellation. However, it is vulnerable to a specific Denial of Service (DoS) attack due to inefficient hostname normalization in its proxy bypass logic, particularly when handling untrusted redirects.
Vulnerability Detail
The vulnerability arises from the shouldBypassProxy() function in Axios, which normalizes hostnames using a regex pattern that can lead to quadratic backtracking. When a hostname is crafted with a long sequence of dots followed by a non-dot character, the regex engine may take an excessive amount of time to process it, blocking the Node.js event loop. This can result in significant CPU usage and unresponsiveness of the application, effectively causing a Denial of Service. The vulnerability is triggered when a malicious server returns a redirect with a specially crafted Location header, exploiting the proxy bypass rules.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable automatic redirects for requests to untrusted servers by setting the maxRedirects option to 0 or by using proxy: false in your Axios requests. For example:
axios.get('http://example.com', { maxRedirects: 0 });
or
axios.get('http://example.com', { proxy: false });
Conclusion
The CVE-2026-101906 vulnerability in Axios poses a significant risk of Denial of Service due to inefficient handling of hostname normalization. It is crucial for developers using Axios to update to the patched version 1.20.0 or later and to consider implementing workarounds to mitigate the risk until they can update.
See every vulnerability recorded for axios →
FAQ
CVE-2026-101906 is a vulnerability in the Axios library that can lead to Denial of Service due to inefficient hostname normalization in proxy bypass logic.
If your application uses Axios with environment proxy variables and follows redirects, it may become unresponsive when interacting with a malicious server that returns crafted redirect locations.
Versions of Axios from 1.15.0 up to, but not including, 1.20.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without signup using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
