Executive brief
axios is a widely-used JavaScript library for making HTTP requests in web applications and Node.js services. A flaw in its string-trimming function allows an attacker to send specially crafted input that causes the library to consume excessive CPU resources, potentially slowing down or freezing services that depend on it.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) flaw in axios before version 0.21.2, located in the trim() function within lib/utils.js. The vulnerable code uses an inefficient regex pattern (/ ^\s* / and / \s* $ /) that can exhibit catastrophic backtracking when processing strings with many whitespace characters. An unauthenticated attacker on the network can trigger this by sending a request with a maliciously crafted header or body containing excessive whitespace, causing the trim function to consume CPU and potentially deny service. The fix, released in v0.21.2, replaces the vulnerable regex with a more efficient pattern using the native trim() method or an optimized regex with atomic grouping.
Affected products
- axios axios before 0.21.2
Timeline
- 2021-09-01: disclosed
- 2021-09-01: patched: Fixed in v0.21.2