CVE-2026-44496

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0

Description Axios constructs a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can trigger expensive regex backtracking while the library reads document.cookie. This leads to a client-side Denial of Service (DoS), which can freeze the affected browser tab and degrade application availability. The issue occurs within the read(name) function in lib/helpers/cookies.js and affects code paths in lib/helpers/resolveConfig.js and lib/adapters/xhr.js. This does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, as these environments do not use document.cookie.

Recommendations Update Axios to version 0.32.0 or later for the 0.x line. Update Axios to version 1.16.0 or later for the 1.x line. Set xsrfCookieName to null if the application does not require axios to read an XSRF cookie. Avoid deriving xsrfCookieName from untrusted input or validate it against a strict allowlist before passing it to axios. Avoid calling axios/unsafe/helpers/cookies.js directly with untrusted names.