CVE-2026-44496: Axios ReDoS via unsanitized XSRF cookie name

Executive brief

Axios is a widely used library for making web requests in browsers and Node.js applications. A security flaw in how it handles security cookies (XSRF) allows an attacker to freeze a user's browser tab by providing a specially crafted cookie name. This results in a denial-of-service for the user, making the application unresponsive, though it does not expose private data or passwords.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the `cookies.read()` function within `lib/helpers/cookies.js`. The library constructs a dynamic regular expression using the `xsrfCookieName` configuration value without escaping regex metacharacters. If an attacker can influence this configuration (e.g., via configuration injection or prototype pollution), they can provide a payload with nested quantifiers (like `(.+)+ ) that triggers catastrophic backtracking when matched against `document.cookie`. This issue specifically affects browser-based environments where `document.cookie` is accessed; Node.js, React Native, and Web Workers are generally unaffected. The fix involves replacing dynamic regex construction with string splitting and exact equality checks.

Affected products

• Axios Axios < 0.32.0, >= 1.0.0 < 1.16.0

Timeline

• 2026-05-30: advisory: Initial GitHub security advisory published
• 2026-06-11: disclosed: CVE-2026-44496 published to NVD

References

• https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf