CVE-2026-101903: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

High severity · published Sep 28, 2026

CVE-2026-101903

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

8.2

CVSS

0.4%

EPSS

On KEV

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 38% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

axios · axios

>= 1.16.1, < 1.20.0 · source: vendor

Affected product

axios