CVE-2026-44496: Axios XSRF Cookie Regex DoS Vulnerability – Security Patch Guidance

Technical summary

The vulnerability stems from unsafe construction of a regular expression using the XSRF cookie name parameter without metacharacter escaping. When axios prepares an HTTP request in a browser environment, it reads document.cookie and applies this unescaped regex pattern. An attacker controlling the cookie name can inject regex metacharacters that cause catastrophic backtracking, where the regex engine consumes exponential CPU resources attempting to match the input. This denial-of-service condition affects only browser contexts where axios reads cookies; server-side Node.js HTTP adapter usage is unaffected because it does not access document.cookie. The issue maps to CWE-1333 (Inefficient Regular Expression Complexity) and CWE-400 (Uncontrolled Resource Consumption), both resource exhaustion weaknesses.

Business impact

Client-side availability is the primary impact. Users accessing web applications built with vulnerable axios versions may experience browser tab freezes, slowdowns, or require manual tab closure and reload. For applications handling sensitive operations (financial transactions, form submissions, API calls), this disruption degrades user experience and could interrupt critical workflows. However, the vulnerability does not leak data or enable unauthorized access. Affected organizations should prioritize patches for customer-facing web applications where user experience directly impacts revenue or satisfaction. Internal tools and APIs may face lower business priority unless they support time-sensitive operations.

Affected systems

This vulnerability affects browser-based JavaScript applications using axios before version 0.32.0 on the 0.x release line or before version 1.16.0 on the 1.x release line. Any web application, single-page application (SPA), or progressive web app (PWA) that includes axios and relies on its XSRF protection is potentially exposed if running in a standard browser environment. Node.js server applications, React Native mobile apps, and web worker contexts are not affected. The severity correlates with how much direct end-user exposure the application has; internal dashboards or B2B tools may have lower blast radius than public-facing consumer applications.

Exploitability

Exploitation requires an attacker to influence the XSRF cookie name passed to axios. In typical configurations, the cookie name is hardcoded in application source code or set by the server, making direct exploitation difficult. However, in scenarios where cookie names are user-controllable or derived from untrusted input (e.g., configuration endpoints, local storage, URL parameters), the risk increases. The attack requires no authentication, no special privileges, and no user interaction beyond normal browsing. The CVSS score of 7.5 reflects a high-severity availability impact across network boundaries. Practical exploitation depends on the specific application architecture and whether any input vectors to the cookie name configuration exist.

Remediation

Update axios to version 0.32.0 or later on the 0.x line, or version 1.16.0 or later on the 1.x line. Most organizations should prioritize the 1.x line, as it is the actively maintained version. Review application manifests and lock files to identify all direct and transitive dependencies on axios. For large applications, test the updated version in a staging environment to confirm compatibility, though these patch releases are designed to be drop-in replacements. If immediate patching is infeasible, assess whether your application's cookie name configuration is exposed to any untrusted input; if the cookie name is strictly hardcoded, risk is mitigated.

Patch guidance

Patching is straightforward: update axios in your package.json or equivalent dependency manager to the fixed versions (0.32.0+ or 1.16.0+), then reinstall dependencies. For npm: `npm install axios@latest` or specify a version constraint like `^1.16.0`. For yarn: `yarn upgrade axios`. Verify the update is reflected in your lock file (package-lock.json or yarn.lock). Re-run your application's test suite and conduct basic smoke testing of XSRF-protected endpoints to ensure the patch does not introduce regressions. Consider automated dependency scanning tools (e.g., Dependabot, Snyk) to flag future vulnerable versions and reduce manual tracking overhead.

Detection guidance

Identify instances of axios in your codebase using static analysis: search package.json files, inspect node_modules, and review transitive dependencies via `npm ls axios` or `yarn list axios`. Compare installed versions against the fixed thresholds (0.32.0 for 0.x, 1.16.0 for 1.x). At runtime, monitor browser console errors or performance degradation that could indicate exploitation attempts, though detection is challenging without application-specific logging. If you have control over the server, verify that XSRF cookie names are hardcoded and not derived from user input. Web Application Firewalls (WAFs) cannot meaningfully detect this client-side issue, as the malicious payload resides in cookies, not in HTTP requests themselves.

Why prioritize this

This vulnerability should be addressed with moderate-to-high priority. The CVSS score of 7.5 and high severity reflect direct user impact. Unlike remote code execution vulnerabilities, the practical harm is limited to availability, not confidentiality or integrity. Customer-facing web applications should be patched within 1–2 weeks. Internal tools and APIs may tolerate slightly longer timelines if operational risk is low. The low barrier to patching (a dependency update) makes this a good candidate for early remediation before more complex vulnerabilities.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects the following factors: (1) the attack vector is Network with no authentication or privileges required, making it broadly exploitable; (2) the attack complexity is Low, meaning a standard browser environment and cookie control suffice; (3) the impact is limited to Availability (denial of service via CPU exhaustion), not Confidentiality or Integrity, which reduces severity below Critical; (4) the User Interaction field is None, indicating the user does not need to click a link or take special action for the freeze to occur. The score appropriately reflects a significant but containable risk that should not delay critical security work on more impactful vulnerabilities.

Frequently asked questions