Inefficient regular expression complexity in axios - CVE-2026-44496

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in lib/helpers/cookies.js read(name) when processing an attacker-controlled XSRF cookie name while reading document.cookie. A remote attacker can supply a crafted cookie name containing regex metacharacters to cause a denial of service.

The issue affects standard browser environments and can freeze the affected browser tab while axios prepares a request. Applications are affected only when attacker-controlled data reaches the XSRF cookie name configuration or an unsafe direct call to the internal cookie helper.

How to mitigate CVE-2026-44496

Sources

• https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf
• https://github.com/axios/axios