Axios, a widely used HTTP client, contains a quadratic regular‑expression that performs host normalization during proxy bypass checks. The vulnerability is triggered when a crafted redirect location includes a long sequence of dots followed by a non‑dot character. Processing this string causes the RegExp engine to backtrack quadratically, potentially blocking the Node.js event loop and leading to a denial of service. The flaw resides in a Parsing and Regular‑Expression weakness (CWE‑1333) and manifests as an unbounded resource consumption issue (CWE‑400).

The affected product is Axios, version 1.15.0 through 1.19.x, inclusive. Any installation that relies on these releases and that configures HTTP_PROXY or HTTPS_PROXY while allowing redirects to untrusted locations can be impacted.

The CVSS score of 8.2 classifies this as a high‑severity weakness. Although the EPSS score is not published, the absence of KEV listing does not diminish the risk; a crafted redirect can be delivered via malicious web content or compromised servers. The likely attack vector is through a redirect endpoint supplied by a third‑party service or attacker‑controlled domain, which is inferred from the description of a redirect Location containing many dots. An attacker with control over such redirects can deploy the payload, forcing the client or server to consume excessive CPU cycles and halt normal operation.