A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service (DoS) by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that consumes excessive computational time. This processing blocks the application's execution thread, leaving the service unresponsive to other requests.
Last checked: 2026-09-30 21:40 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-28 19:15 UTC)
Fix evidence last checked: 2026-10-04 00:33 UTC
Debian 12 (Bookworm)
Debian Security Tracker · Observed 2026-10-04