CVE-2026-101903

Executive Summary

CVE-2026-101903 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Axios HTTP client library, affecting versions 1.16.1 through 1.19.x. The flaw resides in the DATA_URL_PATTERN regular expression used by the fromDataURI function, which allows excessive backtracking when processing malformed data: URLs containing numerous slash characters and no comma. An attacker who can supply an attacker-controlled URL to an application using a vulnerable Axios version can block the Node.js event loop and cause a denial of service.

Technical Analysis

Axios is a promise-based HTTP client widely used in both browser and Node.js environments. The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), commonly known as ReDoS. It occurs because the RFC 2397 regular expression (used to parse data: URI schemes) permits slash characters on both sides of the media-type separator.

When an attacker provides a malformed data: URL that contains many slash characters but lacks the required comma delimiter, the JavaScript regular-expression engine must explore a combinatorial number of potential separator placements before ultimately rejecting the URL. This causes synchronous excessive backtracking within the regex engine. Since JavaScript regex evaluation is synchronous, the Node.js event loop is blocked for the duration of the evaluation. If the input is sufficiently large or crafted, the event loop can be blocked long enough to cause a denial of service for all requests handled by that process.

The affected code identifiers are fromDataURI, DATA_URL_PATTERN, and the data: scheme. The flaw exists from version 1.16.1 until it is fixed in version 1.20.0. No public proof-of-concept or exploit code is available, and no CVSS score or EPSS score has been assigned at the time of this report. The patch confidence is 0/4, indicating no tracked patch evidence despite the NVD description stating the issue is fixed in 1.20.0.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class.

1. Reconnaissance/target identification: An attacker identifies an application that uses a vulnerable version of Axios (1.16.1–1.19.x) and accepts an attacker-controllable string that is eventually passed to fromDataURI or matched against DATA_URL_PATTERN. This could occur in file upload features, URL preview generators, image processors, or any endpoint that accepts data: URI input.

2. Triggering the flaw class: The attacker supplies a malformed data: URL consisting of a valid prefix followed by many slash (/) characters and no comma. For example, a string like data:image/png///////... (with thousands of slashes) but without the terminating comma that would normally delimit the data payload. The regular expression engine then attempts to match the pattern by trying every possible split of the slashes as the media-type separator, leading to exponential backtracking.

3. Payload/execution method: The attacker sends this payload synchronously to an application endpoint that invokes Axios's data URI parsing. Because the regex evaluation is synchronous on the main thread, the Node.js event loop is blocked. The attacker can repeat or parallelize requests to amplify the effect and sustain the denial of service.

4. Post-exploitation impact: The primary impact is availability loss. Depending on the application, the blocked event loop can cause request timeouts, unresponsiveness, and potentially cascading failures in dependent services. No data confidentiality or integrity impact is expected, as the vulnerability does not permit code execution or data exfiltration. The denial of service persists for the duration of the regex evaluation, which scales with the number of slashes provided.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-exploitable, low-complexity vulnerability requiring no privileges or user interaction, with a high impact on availability only. This means an unauthenticated remote attacker can cause a denial of service on affected systems. The blast radius depends on how widely the vulnerable Axios instance is used within the application. In a microservices architecture, a single blocked Node.js process could cause timeouts for upstream services and degrade the overall system. The absence of a CVSS score from NVD and the lack of an EPSS score suggest that this vulnerability may be under-assessed, but the technical mechanism clearly indicates a serious availability risk for Node.js applications that expose data URI parsing to untrusted input.

Detection Guidance

Sigma Rule

title: Axios ReDoS via Malformed Data URI
id: 9a2f3c4e-5b6d-7e8f-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects malformed data URIs with excessive slashes and no comma that may trigger CVE-2026-101903 ReDoS in Axios.
author: Threat Intelligence Team
date: 2026-05-20
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-query|re: 'data:[^,]*/{10,}[^,]*$'
  condition: selection
falsepositives:
  - Legitimate data URIs with many slashes (rare)
level: high
tags:
  - attack.t1499
  - cve.2026-101903

YARA Rule

rule CVE_2026_101903_Axios_ReDoS
{
    meta:
        description = "Detects malformed data URIs exploiting Axios ReDoS CVE-2026-101903"
        author = "Threat Intelligence Team"
        date = "2026-05-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101903"
        severity = "high"
    strings:
        $data = "data:" ascii wide nocase
        $slash = "/" ascii
    condition:
        $data and #slash > 20
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101903 Axios ReDoS Attempt via Malformed Data URI"; flow:to_server,established; http.uri; content:"data:"; nocase; pcre:"/data:[^,]*\\/{10,}[^,]*$/i"; classtype:attempted-dos; sid:2026101903; rev:1; metadata:created_at 2026_05_20, cve CVE-2026-101903;)

Elastic Detection

sequence by host.id, user.id with maxspan=5s
  [network where network.protocol == "http" and url.full : "data:*" and length(url.full) > 200 and stringContains(url.full, "//////")]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "data:[^,]*/{10,}[^,]*$")
| stats count by src_ip, uri, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100903" level="12">
    <decoded_as>web</decoded_as>
    <match>data:[^,]*/{10,}[^,]*$</match>
    <description>CVE-2026-101903: Axios ReDoS attempt via malformed data URI</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_101903,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Upgrade Axios to version 1.20.0 or later as soon as possible, as the NVD description states the issue is fixed in that release.
   • If immediate upgrade is not possible, implement input validation and length restrictions on any user-supplied strings that may be passed to fromDataURI or matched against DATA_URL_PATTERN. Reject or truncate inputs containing excessive slash characters without a comma.
   • Consider running Node.js with --regexp-backtrack-limit (if available in your Node.js version) or using a dedicated worker thread for untrusted regex evaluation to limit event loop blocking.
   • Deploy a Web Application Firewall (WAF) rule to block data URIs with many slashes and no comma.

2. Patch/upgrade steps:

   • Review dependency manifests (package.json, package-lock.json) for Axios versions between 1.16.1 and 1.19.x.
   • Update to Axios 1.20.0 via npm install axios@^1.20.0 or the equivalent for your package manager.
   • Rebuild and redeploy applications, ensuring transitive dependencies are also updated.
   • Verify the fix by testing with a malformed data URI to confirm it is rejected without blocking.

3. Long-term hardening:

   • Adopt a formal dependency vulnerability management program with automated scanning for known CVEs.
   • Enforce input validation and sanitization at all trust boundaries, especially for URL parsing and data URI handling.
   • Monitor Node.js event loop lag and set up alerts for unusual spikes that could indicate ReDoS attacks.
   • Use linters and static analysis tools that detect ReDoS-prone regular expressions (e.g., eslint-plugin-regexp with no-super-linear-backtracking).
   • Consider isolating potentially blocking operations in worker threads to protect the main event loop.

References

1. NVD — CVE-2026-101903: https://nvd.nist.gov/vuln/detail/CVE-2026-101903
2. Axios GitHub Repository: https://github.com/axios/axios
3. Axios Release 1.20.0: https://github.com/axios/axios/releases/tag/v1.20.0
4. CWE-1333: Inefficient Regular Expression Complexity — https://cwe.mitre.org/data/definitions/1333.html
5. OWASP Regular Expression Denial of Service — https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing. CISA KEV status: NO.