Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Date: 2026-06
Affected: npm/axios, npm/axios
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44496
CWE: CWE-1333
CWE-400
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

## Summary Axios versions before `0.32.0` on the `0.x` line and before `1.16.0` on the `1.x` line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads `document.cookie`. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read `document.cookie`. ## Impact Applications are affected only when attacker-controlled data can reach the XSRF cookie name configuration or a direct/unsafe call to the internal cookie helper. This does not expose credentials, modify requests, or affect response integrity. The impact is availability only. ## Affected Functionality Affected code paths: - `lib/helpers/cookies.js` `read(name)` in standard browser environments. - `lib/helpers/resolveConfig.js` in `1.x`, when browser XHR/fetch adapters resolve XSRF config. - `lib/adapters/xhr.js` in `0.x`, when the XHR adapter reads the configured XSRF cookie. - Direct use of `axios/unsafe/helpers/cookies.js` in `1.x`, if callers pass attacker-controlled names. Unaffected code paths: - Default static `xsrfCookieName: 'XSRF-TOKEN'` when not attacker-controlled. - Requests with `xsrfCookieName: null`. - Node H


Mitigations:

Architectural layers (MAESTRO):