CVE catalog

CVE-2026-44496

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF coo

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.41% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-axiossid1.20.0-1fixed
Debiannode-axiosforky1.20.0-1fixed
Debiannode-axiostrixie1.8.4+dfsg-1vulnerable
Debiannode-axiosbookworm1.2.1+dfsg-1+deb12u1vulnerable
Cpenode-axiosNot reportedNot reportedvulnerable
CpeaxiosNot reported0.32.0fixed
CpeaxiosNot reported1.16.0fixed
NpmaxiosNot reported0.32.0fixed
NpmaxiosNot reported0.32.0fixed
CpeaxiosNot reported1.16.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-axiossourcesid1.16.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourceforky1.16.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-axiossourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeaxioscpeNot reported0.32.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.16.0Not reportedNot reportedNot reported
NpmaxiosnpmNot reported0.32.0Not reportedGHSA-HFXV-24RG-XRQFNot reported
NpmaxiosnpmNot reported0.32.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.16.0Not reportedNVD-CVE-2026-44496Not reported

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue; browser-only XSRF cookie read, needs an attacker-controlled xsrfCookieName

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-axios]Affected
    Details (2)

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

[Debian 13 (Trixie)]

  • [node-axios]Affected
    Details (2)

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]