CVE-2026-101906

Executive Summary

CVE-2026-101906 is a denial-of-service vulnerability in Axios, the widely used promise-based HTTP client for the browser and Node.js. In versions 1.15.0 through 1.19.x, the shouldBypassProxy routine applies a quadratic trailing-dot regular expression (Hostname.replace(/.+$/, '')) to redirect hostnames when proxy environment variables (HTTP_PROXY/HTTPS_PROXY) and a non-empty NO_PROXY/no_proxy are configured and redirects are followed. A crafted redirect Location header containing many dots followed by a non-dot character causes the regex engine to backtrack quadratically, blocking the Node.js event loop synchronously and causing denial of service. The issue is resolved in Axios 1.20.0.

Technical Analysis

The vulnerability resides in the proxy-bypass decision logic that Axios executes for every redirect when a proxy is in use. Under normal operation, when HTTP_PROXY or HTTPS_PROXY is set and NO_PROXY/no_proxy is non-empty, Axios evaluates whether the hostname of a redirect target should bypass the proxy. As part of this evaluation, the trailing-dot handling invokes Hostname.replace(/.+$/, '') on the redirect hostname.

The regular expression /.+$/ is the core defect. Because the pattern uses a greedy .+ anchored to end-of-string ($), input that contains a long run of dots followed by a non-dot character forces the regex engine to explore a quadratic number of backtracking positions. Each incremental dot increases the number of candidate starting positions the engine must attempt before failing to match and then re-trying at the next offset. The result is O(n²) behavior relative to the length of the crafted hostname.

Critically, JavaScript regular-expression processing is synchronous. When Axios processes the redirect Location, the backtracking occurs on the main thread, blocking the Node.js event loop. Because the event loop is the mechanism by which Node.js multiplexes all pending I/O and timers, a single crafted redirect can stall the entire process for the duration of the regex evaluation. With sufficiently long dot sequences in an attacker-controlled Location hostname, the stall becomes an effective denial of service against any service that uses Axios as its HTTP client and follows redirects.

The attack precondition set is specific but realistic: (1) a proxy is configured via HTTP_PROXY or HTTPS_PROXY, (2) NO_PROXY/no_proxy is non-empty, and (3) the client follows redirects. This combination is common in corporate and cloud environments where egress traffic is forced through a forward proxy. There is no evidence of a memory-safety issue, remote code execution, or credential exposure — the sole impact vector is availability. No public proof-of-concept, Nuclei template, or exploit code is currently available, and the vulnerability is not listed in CISA KEV. EPSS has not been scored by FIRST.org at the time of writing.

The vulnerability class is a Regular Expression Denial of Service (ReDoS), specifically a polynomial (quadratic) backtracking weakness, which maps to CWE-400 (Uncontrolled Resource Consumption) and aligns with MITRE ATT&CK T1499 (Endpoint Denial of Service).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the conditions stated in the NVD description.

1. Reconnaissance and target identification. An adversary identifies an application or service that uses Axios as its HTTP client and that will follow redirects. Additional confirmation requires knowing or inferring that the deployment routes egress through a forward proxy with a non-empty NO_PROXY/no_proxy list — a common enterprise and containerized configuration. Because Axios is a library rather than a network daemon, reconnaissance is performed against the consuming application, not against Axios itself.

2. Triggering the flaw. The attacker causes the target to make an outbound HTTP request to an attacker-controlled origin (for example, via user-supplied URL fetch, webhook, RSS/feed ingestion, SSRF-adjacent feature, or any server-side "fetch this URL" functionality). The attacker's server responds with a redirect (HTTP 3xx) whose Location header contains a hostname composed of a long run of dots followed by a non-dot character — the exact shape that maximizes quadratic backtracking in Hostname.replace(/.+$/, '').

3. Execution mechanism. With the proxy environment variables set and redirects enabled, Axios processes the crafted Location and evaluates the trailing-dot regular expression synchronously on the Node.js event loop. The regex engine attempts at each starting position, producing quadratic work proportional to the dot run length. Because processing is synchronous, the event loop is blocked for the duration.

4. Post-exploitation impact. The blocked event loop stalls all other requests, timers, and I/O handled by the same Node.js process. Repeated or concurrent triggering sustains the stall, resulting in denial of service. There is no code execution, data exfiltration, or lateral movement inherent to this class; the effect is purely availability degradation of the affected service.

Impact Assessment

The impact is availability-only. A CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflects network reachability (AV:N), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H). The High attack complexity (AC:H) is justified by the specific environmental preconditions: proxy configuration, non-empty NO_PROXY, and redirect following. Where these preconditions already hold, effective complexity is lower than the vector suggests.

Blast radius is determined by how many processes share the affected Node.js runtime. Because the stall blocks the entire event loop, a single targeted request can degrade every concurrent operation handled by that process — API endpoints, background jobs, and health checks. In architectures where Axios is used by a shared gateway, ingestion worker, or BFF (backend-for-frontend), the impact can propagate to all downstream consumers relying on that service. Multi-tenant SaaS platforms, CI/CD runners, and webhook-delivery systems are the most exposed deployments.

No confidentiality or integrity loss is expected, and there is no evidence of worm-like propagation. Business impact is limited to downtime: SLA breaches, failed health checks that trigger cascading restarts, and potential queue backlogs. The absence of a public exploit and of KEV listing suggests current real-world exploitation is opportunistic rather than active, but the low skill barrier for triggering a ReDoS once the preconditions are met makes it a persistent availability risk.

Detection Guidance

Sigma Rule

title: Axios ReDoS via Crafted Redirect Hostname with Dot Run
id: 7f2c9e14-8b3a-4c2a-9f1d-axios-redos-101906
status: experimental
description: Detects Node.js process behavior consistent with Axios quadratic regex backtracking on redirect hostnames containing long dot runs followed by a non-dot character.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101906
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: process
detection:
  selection_cmd:
    Image|endswith: '/node'
  selection_env:
    CommandLine|contains:
      - 'HTTP_PROXY'
      - 'HTTPS_PROXY'
      - 'NO_PROXY'
      - 'no_proxy'
  selection_event:
    EventID: 4688
  condition: (selection_cmd and selection_env) or (selection_event and selection_env)
falsepositives:
  - Legitimate Node.js services using proxies with redirects
level: medium
tags:
  - attack.t1499
  - cwe.400

YARA Rule

rule CVE_2026_101906_Axios_ReDoS_Redirect_Dots
{
    meta:
        description = "Detects crafted redirect Location hostnames with long dot runs targeting Axios shouldBypassProxy ReDoS"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101906"
        date = "2026-01-01"
        cve = "CVE-2026-101906"
    strings:
        $loc = "Location:" ascii nocase
        $proxy = "shouldBypassProxy" ascii
        $dots = /Location:[^\r\n]*\.{16,}[^.\r\n]/
    condition:
        $dots or ($loc and $proxy)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101906 Axios ReDoS Crafted Redirect Hostname Dot Run"; flow:established,to_client; http.response_header; content:"Location|3a|"; nocase; pcre:"/Location\x3a[^\r\n]*\.{16,}[^.\r\n]/i"; reference:cve,2026-101906; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101906; classtype:attempted-dos; sid:2026101906; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "node"
  and process.command_line : ("HTTP_PROXY" or "HTTPS_PROXY" or "NO_PROXY")

Alternative network-focused EQL for environments forwarding proxy logs:

network where network.protocol == "http" and http.response.status_code >= 300
  and http.response.status_code < 400
  and length(http.response.headers.Location.host) > 64
  and stringContains(http.response.headers.Location.host, "..")

Splunk SPL Query

index=proxy OR index=web sourcetype=http:*
| search ("Location" AND "HTTP_PROXY") OR ("NO_PROXY" AND "shouldBypassProxy")
| rex field=_raw "Location:\s*https?://(?<redir_host>[^/\r\n]+)"
| where len(redir_host) > 64
| eval dot_run = mvcount(split(redir_host, "a"))
| where match(redir_host, "\.{16,}[^.\r\n]")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, redir_host
| sort - count

Wazuh OSSEC Rule

<group name="axios,cve-2026-101906,">
  <rule id="2026106" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.response.headers.Location">\.{16,}.*[^.]</field>
    <description>CVE-2026-101906: Axios ReDoS crafted redirect hostname with long dot run detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability,</group>
  </rule>
  <rule id="2026107" level="8">
    <if_sid>2026106</if_sid>
    <field name="process.env.NO_PROXY">.+</field>
    <description>CVE-2026-101906: Node.js Axios proxy bypass path active with crafted redirect</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

• Upgrade Axios to version 1.20.0 or later. The NVD description states the issue is fixed in 1.20.0; this is the authoritative remediation.
• Where immediate upgrade is not possible, disable redirect following on Axios clients that fetch user- or third-party-supplied URLs (set maxRedirects to 0) to eliminate the vulnerable code path entirely.
• Avoid setting NO_PROXY/no_proxy to non-empty values where proxy bypass is not strictly required, since a non-empty value is a stated precondition for the vulnerability.
• Treat all redirect Location values as untrusted; where feasible, run Axios clients in isolated worker processes with request timeouts and watchdog restarts so a blocked event loop cannot stall the primary service.

2. Patch and upgrade steps.

• Update package.json and lockfile to axios@^1.20.0, then rebuild and redeploy affected Node.js services.
• Audit transitive dependencies for pinned Axios versions in the 1.15.0–1.19.x range and force-resolve to 1.20.0 where possible.
• Because no patch evidence was tracked from any source for this identifier, verify the fix against the 1.20.0 release artifacts directly rather than relying on a vendor advisory.

3. Long-term hardening.

• Enforce a policy of not following redirects for externally controlled URLs, or validate redirect destinations against an allowlist before following.
• Add request timeouts and CPU/loop-latency monitoring (event-loop lag metrics) to detect synchronous blocking early.
• Adopt static analysis and CI checks that flag nested or greedy quantifiers on unbounded input (ReDoS-class detection) in JavaScript/Node.js dependencies.
• Maintain an SBOM and track Axios versions across services to enable rapid response to future advisories.

References

• NVD — CVE-2026-101906: https://nvd.nist.gov/vuln/detail/CVE-2026-101906
• Axios project repository and releases (fix version 1.20.0): https://github.com/axios/axios/releases
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• OWASP — Regular Expression Denial of Service (ReDoS): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-101906 at the time of writing. The vulnerability is not listed in CISA KEV, has no public PoC, no Nuclei template, and no available exploit code. EPSS has not been scored by FIRST.org.