Node axios: Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name… (CVE-2026-44496)

Axios, a promise-based HTTP client for browsers and Node.js, improperly constructs a regular expression from the configured XSRF cookie name without escaping regex metacharacters in versions prior to 0.32.0 (0.x line) and 1.16.0 (1.x line). In standard browser environments, an attacker able to influence the cookie name can trigger expensive regex backtracking while axios reads document.cookie, causing client-side availability issues such as freezing the browser tab. This vulnerability does not impact Node.js HTTP adapter usage, React Native, or web workers where document.cookie is not read. The flaw is resolved in axios versions 0.32.0 and 1.16.0.

The vulnerability causes client-side availability degradation by enabling an attacker to induce expensive regex backtracking in the browser, potentially freezing the affected browser tab during axios request preparation. There is no impact on confidentiality or integrity, and the issue does not affect server-side Node.js usage or other environments like React Native or web workers.

Upgrade axios to version 0.32.0 or later on the 0.x line, or to version 1.16.0 or later on the 1.x line, where this vulnerability is fixed. No other mitigation is required as the issue is resolved in these versions.