Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.
Published: 2026-09-28
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via event loop freeze
Action: Patch
AI Analysis

Impact

A malformed data URL with an excess of slash characters and no comma triggers the RFC 2397 regular expression used by axios's fromDataURI function to explore many separator placements. The synchronous regex backtracking blocks the Node.js event loop, resulting in a denial of service. This weakness is a regular expression denial of service reflected by CWE-1333.

Affected Systems

Affected systems: Axios versions 1.16.1 up to 1.19.x are affected. The issue appears in the fromDataURI, DATA_URL_PATTERN, and data: identifiers. Systems that use any of these functions in a Node.js environment or in client-side code with the vulnerable axios library could be impacted.

Risk and Exploitability

This vulnerability carries a high CVSS score of 8.2. It is not currently listed in the CISA KEV catalog and no EPSS score is available. While the attack does not require elevated privileges, an attacker can supply a malicious data URL to an axios request crafted by untrusted input, causing the entire Node event loop to stop and denying service to all pending or new requests. The impact is a complete denial of service on affected services until the application is restarted or the vulnerability is patched.

Generated by OpenCVE AI on September 28, 2026 at 19:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the axios library to version 1.20.0 or later, ensuring that all instances of axios in the project use the updated dependency.
  • Remove or sanitize any use of fromDataURI or data URLs with untrusted input, or implement custom validation that rejects URLs containing excessive slash characters.
  • Isolate vulnerable axios usage by offloading requests that contain data URLs to a dedicated worker process or thread to prevent event loop blocking.

Generated by OpenCVE AI on September 28, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c29m-xwm3-cm6r Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
History

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Axios
Axios axios
Vendors & Products Axios
Axios axios
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.
Title Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Weaknesses CWE-1333
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Axios Axios
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T17:49:24.777Z

Reserved: 2026-09-28T15:55:37.907Z

Link: CVE-2026-101903

cve-icon Vulnrichment

Updated: 2026-09-28T17:49:00.535Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T18:17:18.560

Modified: 2026-09-30T19:38:27.293

Link: CVE-2026-101903

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-28T17:25:04Z

Links: CVE-2026-101903 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:30:02Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity