Search: CVE-2026-44496

Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line have a vulnerability where a regular expression is built from the configured XSRF cookie name without escaping regex metacharacters. This can cause expensive regex backtracking in browsers, leading to client-side availability degradation such as freezing the browser tab during request preparation. The issue does not affect Node.js HTTP adapter usage, React Native, or web workers. The vulnerability is fixed in versions 0.32.0 and 1.16.0.