CVE-2026-101906
Fixed in a distro release EPSS <1%CVSS 8.2
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.20.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | awx | 24.6.1-r66 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.8-r8 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.7-r6 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.3-r5 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.1-r3 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r2 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.7-r5 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.3-r3 |
| Chainguard | gitlab-rails-ce-fips-19.4 | 19.4.1-r5 |
| Chainguard | kibana-8.19 | 8.19.22-r4 |
| Chainguard | kibana-8.19-bitnami | 8.19.22-r4 |
| Chainguard | kibana-9.2 | 9.2.8-r25 |
| Chainguard | kibana-9.3 | no fix |
| Chainguard | kubeflow-centraldashboard | 2.0.0-r5 |
| Chainguard | lambda-nodejs22 | 4.0.2-r4 |
| Chainguard | lambda-nodejs24 | 4.0.2-r4 |
| Chainguard | langfuse-3 | 3.225.11-r2 |
| Chainguard | langfuse-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-4 | 4.49.0-r0 |
| Chainguard | langfuse-4-worker | 4.49.0-r0 |
| Chainguard | langfuse-fips-3 | 3.225.11-r2 |
| Chainguard | langfuse-fips-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-fips-4 | 4.49.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.49.0-r0 |
| Chainguard | lerna | 10.0.1-r8 |
| Chainguard | librechat | 0.8.7-r16 |
| Chainguard | nextcloud-server-33 | 33.0.9-r1 |
| Chainguard | nextcloud-server-34 | 34.0.4-r2 |
| Chainguard | nextcloud-server-35 | 35.0.0-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r21 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.6-r10 |
| Chainguard | opensearch-dashboards-3 | 3.8.0-r8 |
| Chainguard | opensearch-dashboards-3-fips | 3.8.0-r5 |
| Chainguard | prism | 5.16.0-r13 |
| Chainguard | redisinsight | 3.8.0-r8 |
| Chainguard | semaphore | 2.19.12-r3 |
| Chainguard | wazuh-dashboard | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-fips | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-plugins | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-plugins-fips | 4.14.8-r3 |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.20.0-1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.3.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.6-0.6.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.9.hum1 |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | kubeflow-centraldashboard | 2.0.0-r5 |
| Wolfi | langfuse-3 | 3.225.11-r2 |
| Wolfi | langfuse-3-worker | 3.225.11-r2 |
| Wolfi | lerna | 10.0.1-r8 |
| Wolfi | nextcloud-server-33 | 33.0.9-r1 |
| Wolfi | opensearch-dashboards-3 | 3.8.0-r8 |
| Wolfi | prism | 5.16.0-r13 |