CVE-2026-44496

What it actually does

Axios browser builds before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line construct a regular expression from the configured XSRF cookie name without escaping regular-expression metacharacters. In a standard browser context, if attacker-controlled input can influence the axios XSRF cookie name, a crafted value can trigger catastrophic or expensive regex backtracking when axios reads document.cookie while preparing a request. The result is client-side denial of service, typically freezing or severely slowing the browser tab. Ordinary Node.js HTTP adapter usage, React Native, and web workers are not affected because those environments do not use the vulnerable document.cookie path.

Why it matters to the business

Applications that expose or indirectly derive the axios XSRF cookie name from untrusted input may experience browser tab freezes or degraded client-side availability for users. This can interrupt user workflows, reduce conversion or productivity, increase support volume, and create a poor user experience, but it is not expected to expose data or allow server compromise by itself. The issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported exploit maturity, so urgency is highest for internet-facing browser applications that customize axios XSRF settings or use user-influenced configuration.

How an attack unfolds

An attacker first identifies a web application using an affected axios version in a browser environment. They then find a way to influence the value supplied to axios as the XSRF cookie name, such as through application configuration, query-driven runtime options, plugin settings, embedded widgets, or other untrusted data paths. The attacker supplies a cookie-name value containing regex metacharacters designed to cause excessive backtracking. When axios prepares a browser request and attempts to read document.cookie using the generated regular expression, the browser performs expensive regex evaluation. This can monopolize the JavaScript thread, making the affected page or tab unresponsive until the operation completes or the user closes the tab.

How to fix it

Upgrade axios to a fixed release: use axios 0.32.0 or later for the 0.x line, or axios 1.16.0 or later for the 1.x line. Prefer the latest supported 1.x release where compatibility allows. Rebuild and redeploy browser bundles after upgrading, because client-side applications often continue serving the vulnerable dependency until static assets are regenerated and caches/CDNs are refreshed. If immediate upgrade is not possible, ensure xsrfCookieName is a hard-coded trusted value, do not derive it from user input, sanitize or reject regex metacharacters in any value that can reach xsrfCookieName, and disable or avoid custom XSRF cookie-name handling where it is unnecessary. Node.js-only axios usage with the standard HTTP adapter, React Native, and web workers are not affected by this specific document.cookie behavior, but dependency upgrades are still recommended for consistency and future maintenance.

How to confirm the fix worked

Confirm dependency versions in package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, SBOMs, and built artifacts. Verify that every browser-delivered bundle uses axios 0.32.0 or later on the 0.x line, or 1.16.0 or later on the 1.x line. Search application code for axios configuration that sets xsrfCookieName and confirm the value is constant or derived only from trusted sources. After deployment, clear or invalidate CDN and browser caches for rebuilt JavaScript assets. Functional validation should include exercising request flows that use axios in a browser and confirming the page remains responsive when XSRF options are used. If a temporary mitigation is applied instead of upgrading, test that values containing regex metacharacters are rejected or escaped before reaching axios configuration.

Typical attack path

1. Identify a browser-based application bundle that includes axios before 0.32.0 on the 0.x line or before 1.16.0 on the 1.x line.
2. Determine whether the application customizes axios XSRF behavior, especially the xsrfCookieName option.
3. Find an input path that can influence the configured XSRF cookie name or axios request configuration.
4. Submit a crafted cookie-name value containing regex metacharacters that induce expensive backtracking.
5. Trigger an axios request in the affected browser context.
6. Cause the page or browser tab to freeze or become significantly degraded while axios reads document.cookie.

How to detect it

This issue is primarily client-side and may not leave definitive server-side compromise artifacts. Look for evidence of attempts to control axios XSRF configuration, especially unusual values assigned to xsrfCookieName or equivalent application settings. Useful sources include web access logs, WAF logs, CDN logs, frontend telemetry, real-user monitoring, browser performance monitoring, JavaScript error reporting, and support reports of page freezes. Investigate requests containing suspicious regex metacharacter sequences in parameters or configuration fields that affect client behavior. Correlate spikes in long tasks, browser tab hangs, aborted sessions, or repeated reloads with application routes that initialize axios or customize XSRF settings. There are no known public threat actors or KEV-listed exploitation campaigns for this vulnerability at the time of this intelligence, so detection should focus on suspicious input patterns and user-experience telemetry rather than known malware artifacts.

• xsrfCookieName
• XSRF-TOKEN
• document.cookie
• axios.defaults.xsrfCookieName
• withXSRFToken
• xsrfCookieName=.*(.*)+
• xsrfCookieName=.*(.+)+
• xsrfCookieName=.*(a+)+
• xsrfCookieName=.*([a-zA-Z]+)*
• xsrfCookieName=.*(.*){
• xsrfCookieName=.*|.*
• xsrfCookieName=.*\(.*\)\+
• xsrfCookieName=.*\[.*\]\+
• axios@0.31.
• axios@0.30.
• axios@0.29.
• axios@0.28.
• axios@0.27.
• axios@0.26.
• axios@0.25.
• axios@0.24.
• axios@0.23.
• axios@0.22.
• axios@0.21.
• axios@1.15.
• axios@1.14.
• axios@1.13.
• axios@1.12.
• axios@1.11.
• axios@1.10.
• axios@1.9.
• axios@1.8.
• axios@1.7.
• axios@1.6.
• axios@1.5.
• axios@1.4.
• axios@1.3.
• axios@1.2.
• axios@1.1.
• axios@1.0.

What your security team should do

• Inventory applications and packages that include axios in browser-delivered code, prioritizing externally accessible and high-traffic applications.
• Upgrade axios to 0.32.0 or later on the 0.x line, or 1.16.0 or later on the 1.x line, and redeploy rebuilt browser assets.
• Search source code and runtime configuration for xsrfCookieName and verify it is not influenced by URL parameters, user profile data, third-party widget configuration, local storage, postMessage data, or other untrusted inputs.
• If upgrade cannot be completed immediately, enforce an allowlist for XSRF cookie names and block regex metacharacters in any configurable cookie-name value.
• Add dependency-scanning gates to prevent reintroduction of axios versions before 0.32.0 on 0.x or before 1.16.0 on 1.x.
• Review frontend telemetry, browser error reports, real-user monitoring data, and support reports for clusters of browser hangs or long JavaScript tasks associated with axios request preparation.