CVE-2026-44496: Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Synopsis

A Regular Expression Denial of Service (ReDoS) vulnerability affects the Axios HTTP client library in versions before 0.32.0 (0.x line) and before 1.16.0 (1.x line). The flaw is reachable over the network without authentication and requires no user interaction; an attacker who can influence the XSRF cookie name passed to Axios can trigger catastrophic regex backtracking in the browser, causing the affected tab to freeze or become unresponsive. Successful exploitation degrades client-side availability but does not expose or modify data. HarborGuard tracks this advisory and will make a patched-image rebuild available at versions 0.32.0 and 1.16.0 for affected environments once images incorporating those releases are present in customer registries.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exercised in browser environments where Axios is loaded and making HTTP requests, meaning an attacker must be able to influence a cookie name delivered over the network to the affected browser context.

• AuthenticationNot required

  No authentication is needed; the attacker only needs the ability to set or influence a cookie name that Axios will consume, with no account or credential required.

• Victim interactionNot required

  Axios reads document.cookie automatically as part of preparing a request, so no deliberate victim action beyond normal page use is needed to trigger the backtracking.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free once the attacker controls or can inject a crafted cookie name, with no race condition or special environmental setup required.

Blast Radius

• Freezes or severely stalls the affected browser tab while Axios processes the malicious cookie name, making the page unresponsive to the user.
• Repeated triggering can exhaust JavaScript engine CPU time, causing sustained denial of service for any web application relying on Axios for HTTP requests in that browser context.
• Confidentiality and data integrity are not affected; the vulnerability is limited to availability of the client-side application.