{
"document": {
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "National Cyber Security Centre",
"namespace": "https://www.ncsc.nl/"
},
"title": "CVE-2026-101906",
"tracking": {
"current_release_date": "2026-10-21T10:08:25.369084Z",
"generator": {
"date": "2026-02-17T15:00:00Z",
"engine": {
"name": "V.E.L.M.A",
"version": "1.7"
}
},
"id": "CVE-2026-101906",
"initial_release_date": "2026-09-28T17:38:31.878620Z",
"revision_history": [
{
"date": "2026-09-28T17:38:31.878620Z",
"number": "1",
"summary": "CVSS created.| CWES created (2).| Products created (1).| References created (4).| Description created for source.| Unknown change."
},
{
"date": "2026-09-28T17:38:33.148083Z",
"number": "2",
"summary": "NCSC Score created."
},
{
"date": "2026-09-28T18:28:52.800878Z",
"number": "3",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)."
},
{
"date": "2026-09-28T18:29:03.524914Z",
"number": "4",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-28T19:38:34.459128Z",
"number": "5",
"summary": "Unknown change."
},
{
"date": "2026-09-29T06:13:09.906646Z",
"number": "6",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (9).| References created (6).| CWES updated (1)."
},
{
"date": "2026-09-29T12:29:32.961273Z",
"number": "7",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (5).| Product Identifiers created (1).| References created (6).| CWES updated (1).| Vendor_assessment created."
},
{
"date": "2026-09-29T12:29:38.026002Z",
"number": "8",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-29T12:53:04.237474Z",
"number": "9",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)."
},
{
"date": "2026-09-29T12:53:21.586544Z",
"number": "10",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-29T16:12:56.774730Z",
"number": "11",
"summary": "EPSS created.| Unknown change."
},
{
"date": "2026-09-29T16:13:03.052139Z",
"number": "12",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-30T15:40:03.727852Z",
"number": "13",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)."
},
{
"date": "2026-09-30T15:40:12.554589Z",
"number": "14",
"summary": "NCSC Score updated."
},
{
"date": "2026-10-04T00:44:30.629716Z",
"number": "15",
"summary": "Products connected (1).| Products removed (1)."
},
{
"date": "2026-10-21T10:05:52.480856Z",
"number": "16",
"summary": "Source connected.| CVE status created. (valid)| Products connected (12).| References created (3)."
},
{
"date": "2026-10-21T10:05:54.925610Z",
"number": "17",
"summary": "NCSC Score updated."
}
],
"status": "interim",
"version": "17"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/>=1.15.0|<1.20.0",
"product": {
"name": "vers:unknown/>=1.15.0|<1.20.0",
"product_id": "CSAFPID-9482813"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.15.0",
"product": {
"name": "vers:unknown/v1.15.0",
"product_id": "CSAFPID-8580142"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.15.1",
"product": {
"name": "vers:unknown/v1.15.1",
"product_id": "CSAFPID-8580141"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.15.2",
"product": {
"name": "vers:unknown/v1.15.2",
"product_id": "CSAFPID-8583063"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.16.0",
"product": {
"name": "vers:unknown/v1.16.0",
"product_id": "CSAFPID-8925641"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.16.1",
"product": {
"name": "vers:unknown/v1.16.1",
"product_id": "CSAFPID-8925639"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.17.0",
"product": {
"name": "vers:unknown/v1.17.0",
"product_id": "CSAFPID-8925638"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.18.0",
"product": {
"name": "vers:unknown/v1.18.0",
"product_id": "CSAFPID-9484963"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.18.1",
"product": {
"name": "vers:unknown/v1.18.1",
"product_id": "CSAFPID-9484962"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.19.0",
"product": {
"name": "vers:unknown/v1.19.0",
"product_id": "CSAFPID-9484961"
}
}
],
"category": "product_name",
"name": "Axios"
}
],
"category": "vendor",
"name": "Axios"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.2.24",
"product": {
"name": "vers:unknown/lts <10.2.24",
"product_id": "CSAFPID-9773074"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <12.1.12",
"product": {
"name": "vers:unknown/lts <12.1.12",
"product_id": "CSAFPID-9773077"
}
}
],
"category": "product_name",
"name": "Bamboo"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<10.5.1",
"product": {
"name": "vers:unknown/<10.5.1",
"product_id": "CSAFPID-9527307"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.2.8",
"product": {
"name": "vers:unknown/lts <10.2.8",
"product_id": "CSAFPID-9773075"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <9.4.26",
"product": {
"name": "vers:unknown/lts <9.4.26",
"product_id": "CSAFPID-9773079"
}
}
],
"category": "product_name",
"name": "Bitbucket"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<11.0.0",
"product": {
"name": "vers:unknown/<11.0.0",
"product_id": "CSAFPID-9773080"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.2.19",
"product": {
"name": "vers:unknown/lts <10.2.19",
"product_id": "CSAFPID-9773081"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <9.2.26",
"product": {
"name": "vers:unknown/lts <9.2.26",
"product_id": "CSAFPID-9773082"
}
}
],
"category": "product_name",
"name": "Confluence"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<4.9.15",
"product": {
"name": "vers:unknown/<4.9.15",
"product_id": "CSAFPID-9527315"
}
}
],
"category": "product_name",
"name": "Crucible"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<4.9.15",
"product": {
"name": "vers:unknown/<4.9.15",
"product_id": "CSAFPID-9527321"
}
}
],
"category": "product_name",
"name": "Fisheye"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.3.26",
"product": {
"name": "vers:unknown/lts <10.3.26",
"product_id": "CSAFPID-9773078"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <11.3.12",
"product": {
"name": "vers:unknown/lts <11.3.12",
"product_id": "CSAFPID-9773076"
}
}
],
"category": "product_name",
"name": "Jira"
}
],
"category": "vendor",
"name": "Atlassian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/1",
"product": {
"name": "vers:rpm/1",
"product_id": "CSAFPID-6014972",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_name",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-8902830"
}
}
],
"category": "product_name",
"name": "grafana12.4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-8902831"
}
}
],
"category": "product_name",
"name": "grafana13.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-9053231"
}
}
],
"category": "product_name",
"name": "grafana13.2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-8476867"
}
}
],
"category": "product_name",
"name": "jaeger"
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:deb/*",
"product": {
"name": "vers:deb/*",
"product_id": "CSAFPID-1409455"
}
}
],
"category": "product_name",
"name": "node-axios"
}
],
"category": "product_family",
"name": "bookworm"
}
],
"category": "vendor",
"name": "Debian"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-101906",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"notes": [
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.",
"title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101906"
},
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.",
"title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101906"
},
{
"category": "description",
"text": "A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service (DoS) by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that consumes excessive computational time. This processing blocks the application's execution thread, leaving the service unresponsive to other requests.",
"title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101906"
},
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.",
"title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101906"
},
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.",
"title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101906.json?alt=media"
},
{
"category": "description",
"text": "## Summary\n\nAxios `shouldBypassProxy()` normalizes hostnames with `hostname.replace(/\\.+$/, '')`. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can trigger this synchronous work through a crafted redirect `Location`.\n\nThe issue affects Node.js applications that use environment proxy variables with `NO_PROXY` and allow redirects.\n\n## Impact\n\nAn attacker-controlled server can return a redirect whose hostname causes the axios process to spend significant CPU time in synchronous hostname normalization. During this time, the Node.js event loop is blocked and the application cannot handle other work on that thread.\n\nThis is an availability-only issue. It does not disclose request data or modify requests.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js HTTP adapter.\n- Environment proxy handling through `HTTP_PROXY` or `HTTPS_PROXY`.\n- `NO_PROXY` or `no_proxy` set to a non-empty value.\n- Redirects followed by axios or `follow-redirects`.\n\nNot affected:\n\n- Browser adapters.\n- Requests with `proxy: false`.\n- Requests with no `NO_PROXY` value.\n- Requests with `maxRedirects: 0`, unless application code manually follows the malicious redirect and re-enters axios.\n\n## Technical Details\n\n`lib/helpers/shouldBypassProxy.js` contains:\n\n```js\nreturn unmapIPv4MappedIPv6(hostname.replace(/\\.+$/, ''));\n```\n\nWhen the hostname is `\".\" * n + \"a\"`, the `$` anchor causes the regex engine to retry the dot run from many positions before it fails. `setProxy()` invokes `shouldBypassProxy(location)` after `getProxyForUrl(location)` returns a proxy, including on redirect hops via `beforeRedirects.proxy`.\n\nLocal timing on axios `1.18.1` showed increasing cost for crafted hostnames: about 1 ms at 1000 dots, 6.9 ms at 3000 dots, and 34.5 ms at 6000 dots. The growth is consistent with the submitted quadratic claim while avoiding long-running payloads.\n\n## Proof of Concept of Attack\n\nConstrained helper-level demonstration:\n\n```js\nimport shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js';\n\nprocess.env.NO_PROXY = 'example.com';\nshouldBypassProxy('http://' + '.'.repeat(6000) + 'a/');\n```\n\nIn the full adapter path, a malicious server can return that hostname in a `302 Location` header while the client has proxy environment variables and `NO_PROXY` configured.\n\n## Workarounds\n\nDisable automatic redirects for requests to untrusted servers, or avoid environment proxy handling for those requests with `proxy: false` when appropriate. Operators can also avoid broad untrusted redirect-following in services where event-loop availability is critical.\n\n\n Original report
\n \n### Summary\n\nshouldBypassProxy normalizes a host with hostname.replace(/\\.+$/, ''). On a host of the shape (e.g. \".\" × 40000 + \"a\"), this anchored regex backtracks quadratically (O(N²)), synchronously starving the Node.js event loop. Because axios re-evaluates the proxy on every redirect using the new Location host, a malicious server can return a crafted 302 Location and freeze the client's event loop for seconds per redirect — a denial of service.\n\n### Details\n\n- Affected code: lib/helpers/shouldBypassProxy.js → normalizeNoProxyHost: hostname.replace(/\\.+$/, '') (one pass in 1.18.1). The open PR #11029 adds a second /\\.+$/ pass in normalizeIPAddress, doubling the cost (not the origin).\n- Root cause: /\\.+$/ is O(N²) on a long run of dots that is not at the end of the string — the $ anchor forces the engine to backtrack the entire dot-run from every start position.\n- Trust boundary (per THREATMODEL): the redirect Location is untrusted (T-2: \"axios to network … redirect Location … untrusted\"). The caller requests a benign URL; the malicious host arrives via the server's 302. This is not the T-1 caller-supplied-URL non-goal.\n- Call chain: setProxy(options, configProxy, location, isRedirect, …) (lib/adapters/http.js) → env-proxy branch → getProxyForUrl(location) returns a proxy → if (!shouldBypassProxy(location)) → normalizeNoProxyHost(parsed.hostname.toLowerCase()) runs /\\.+$/. setProxy is re-invoked on the redirect hop with the untrusted Location; new URL() retains the long dot-run in .hostname.\n- Preconditions: proxy configured via environment (HTTP_PROXY/HTTPS_PROXY, trusted per THREATMODEL T-3, common in CI/containers/enterprise) + NO_PROXY set + redirects followed (default maxRedirects: 5).\n\n### PoC\n\nSelf-contained, no network — imports axios's own helper:\n// node poc.mjs (run next to an axios install)\nimport sbp from './node_modules/axios/lib/helpers/shouldBypassProxy.js';\nprocess.env.NO_PROXY = 'example.com';\nfor (const n of [5000, 10000, 20000, 40000]) {\n const url = 'http://' + '.'.repeat(n) + 'a/'; // arrives as an untrusted 302 Location host\n const t0 = process.hrtime.bigint();\n sbp(url); // returns false (correct no-bypass) — but O(N^2) slow\n console.log(`N=${n}: ${(Number(process.hrtime.bigint()-t0)/1e6)|0} ms`);\n}\n// Measured on 1.18.1: N=5000 ~43ms, 10000 ~160ms, 20000 ~618ms, 40000 ~2499ms; benign host ~0.05ms.\nDriven through the real http-adapter __setProxy on the redirect path (setProxy(…, isRedirect=true)), a 10 ms timer fires 0 times during the ~2.4 s block at N=40000 — full event-loop starvation.\n\n### Impact\n\nDenial of service (event-loop starvation) on any axios client that uses an environment proxy with NO_PROXY set and follows redirects, when a server it contacts returns a crafted redirect Location. No data exposure or RCE. Same impact class as the accepted DoS advisories GHSA-62hf-57xw-28j9 (toFormData recursion) and the maxContentLength response-size DoS.\n\n### Suggested fix\n\nReplace the regex trailing-dot strip with a linear trim:\nlet end = hostname.length;\nwhile (end > 0 && hostname.charCodeAt(end - 1) === 46 /* '.' */) end--;\nhostname = hostname.slice(0, end);\nAlso drop the redundant second /\\.+$/ pass in PR #11029's normalizeIPAddress.\n \n\n---",
"title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-mghh-pgcx-3jjj.json?alt=media"
},
{
"category": "description",
"text": "## Summary\n\nAxios `shouldBypassProxy()` normalizes hostnames with `hostname.replace(/\\.+$/, '')`. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can trigger this synchronous work through a crafted redirect `Location`.\n\nThe issue affects Node.js applications that use environment proxy variables with `NO_PROXY` and allow redirects.\n\n## Impact\n\nAn attacker-controlled server can return a redirect whose hostname causes the axios process to spend significant CPU time in synchronous hostname normalization. During this time, the Node.js event loop is blocked and the application cannot handle other work on that thread.\n\nThis is an availability-only issue. It does not disclose request data or modify requests.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js HTTP adapter.\n- Environment proxy handling through `HTTP_PROXY` or `HTTPS_PROXY`.\n- `NO_PROXY` or `no_proxy` set to a non-empty value.\n- Redirects followed by axios or `follow-redirects`.\n\nNot affected:\n\n- Browser adapters.\n- Requests with `proxy: false`.\n- Requests with no `NO_PROXY` value.\n- Requests with `maxRedirects: 0`, unless application code manually follows the malicious redirect and re-enters axios.\n\n## Technical Details\n\n`lib/helpers/shouldBypassProxy.js` contains:\n\n```js\nreturn unmapIPv4MappedIPv6(hostname.replace(/\\.+$/, ''));\n```\n\nWhen the hostname is `\".\" * n + \"a\"`, the `$` anchor causes the regex engine to retry the dot run from many positions before it fails. `setProxy()` invokes `shouldBypassProxy(location)` after `getProxyForUrl(location)` returns a proxy, including on redirect hops via `beforeRedirects.proxy`.\n\nLocal timing on axios `1.18.1` showed increasing cost for crafted hostnames: about 1 ms at 1000 dots, 6.9 ms at 3000 dots, and 34.5 ms at 6000 dots. The growth is consistent with the submitted quadratic claim while avoiding long-running payloads.\n\n## Proof of Concept of Attack\n\nConstrained helper-level demonstration:\n\n```js\nimport shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js';\n\nprocess.env.NO_PROXY = 'example.com';\nshouldBypassProxy('http://' + '.'.repeat(6000) + 'a/');\n```\n\nIn the full adapter path, a malicious server can return that hostname in a `302 Location` header while the client has proxy environment variables and `NO_PROXY` configured.\n\n## Workarounds\n\nDisable automatic redirects for requests to untrusted servers, or avoid environment proxy handling for those requests with `proxy: false` when appropriate. Operators can also avoid broad untrusted redirect-following in services where event-loop availability is critical.\n\n\n Original report
\n \n### Summary\n\nshouldBypassProxy normalizes a host with hostname.replace(/\\.+$/, ''). On a host of the shape (e.g. \".\" × 40000 + \"a\"), this anchored regex backtracks quadratically (O(N²)), synchronously starving the Node.js event loop. Because axios re-evaluates the proxy on every redirect using the new Location host, a malicious server can return a crafted 302 Location and freeze the client's event loop for seconds per redirect — a denial of service.\n\n### Details\n\n- Affected code: lib/helpers/shouldBypassProxy.js → normalizeNoProxyHost: hostname.replace(/\\.+$/, '') (one pass in 1.18.1). The open PR #11029 adds a second /\\.+$/ pass in normalizeIPAddress, doubling the cost (not the origin).\n- Root cause: /\\.+$/ is O(N²) on a long run of dots that is not at the end of the string — the $ anchor forces the engine to backtrack the entire dot-run from every start position.\n- Trust boundary (per THREATMODEL): the redirect Location is untrusted (T-2: \"axios to network … redirect Location … untrusted\"). The caller requests a benign URL; the malicious host arrives via the server's 302. This is not the T-1 caller-supplied-URL non-goal.\n- Call chain: setProxy(options, configProxy, location, isRedirect, …) (lib/adapters/http.js) → env-proxy branch → getProxyForUrl(location) returns a proxy → if (!shouldBypassProxy(location)) → normalizeNoProxyHost(parsed.hostname.toLowerCase()) runs /\\.+$/. setProxy is re-invoked on the redirect hop with the untrusted Location; new URL() retains the long dot-run in .hostname.\n- Preconditions: proxy configured via environment (HTTP_PROXY/HTTPS_PROXY, trusted per THREATMODEL T-3, common in CI/containers/enterprise) + NO_PROXY set + redirects followed (default maxRedirects: 5).\n\n### PoC\n\nSelf-contained, no network — imports axios's own helper:\n// node poc.mjs (run next to an axios install)\nimport sbp from './node_modules/axios/lib/helpers/shouldBypassProxy.js';\nprocess.env.NO_PROXY = 'example.com';\nfor (const n of [5000, 10000, 20000, 40000]) {\n const url = 'http://' + '.'.repeat(n) + 'a/'; // arrives as an untrusted 302 Location host\n const t0 = process.hrtime.bigint();\n sbp(url); // returns false (correct no-bypass) — but O(N^2) slow\n console.log(`N=${n}: ${(Number(process.hrtime.bigint()-t0)/1e6)|0} ms`);\n}\n// Measured on 1.18.1: N=5000 ~43ms, 10000 ~160ms, 20000 ~618ms, 40000 ~2499ms; benign host ~0.05ms.\nDriven through the real http-adapter __setProxy on the redirect path (setProxy(…, isRedirect=true)), a 10 ms timer fires 0 times during the ~2.4 s block at N=40000 — full event-loop starvation.\n\n### Impact\n\nDenial of service (event-loop starvation) on any axios client that uses an environment proxy with NO_PROXY set and follows redirects, when a server it contacts returns a crafted redirect Location. No data exposure or RCE. Same impact class as the accepted DoS advisories GHSA-62hf-57xw-28j9 (toFormData recursion) and the maxContentLength response-size DoS.\n\n### Suggested fix\n\nReplace the regex trailing-dot strip with a linear trim:\nlet end = hostname.length;\nwhile (end > 0 && hostname.charCodeAt(end - 1) === 46 /* '.' */) end--;\nhostname = hostname.slice(0, end);\nAlso drop the redundant second /\\.+$/ pass in PR #11029's normalizeIPAddress.\n \n\n---",
"title": "github - https://github.com/advisories/GHSA-mghh-pgcx-3jjj"
},
{
"category": "other",
"text": "0.00402",
"title": "EPSS"
},
{
"category": "other",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
},
{
"category": "other",
"text": "8.2",
"title": "CVSSV4 base score"
},
{
"category": "other",
"text": "4.0",
"title": "NCSC Score"
},
{
"category": "other",
"text": "There is product data available from source Certbundde",
"title": "NCSC Score top increasing factors"
},
{
"category": "other",
"text": "The CVSS vector string contains AV:N (Attack Vector: Network), The value of the most recent CVSS (V3) score, The value of the mean historic EPSS score, Is related to an uncommon product vendor",
"title": "NCSC Score top decreasing factors"
},
{
"category": "details",
"text": "Severity: 3\n",
"title": "Vendor assessment"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9482813",
"CSAFPID-6014972",
"CSAFPID-8902830",
"CSAFPID-8902831",
"CSAFPID-9053231",
"CSAFPID-8580142",
"CSAFPID-8580141",
"CSAFPID-8583063",
"CSAFPID-8925641",
"CSAFPID-8925639",
"CSAFPID-8925638",
"CSAFPID-9484963",
"CSAFPID-9484962",
"CSAFPID-9484961",
"CSAFPID-9527307",
"CSAFPID-9527315",
"CSAFPID-9527321",
"CSAFPID-9773074",
"CSAFPID-9773075",
"CSAFPID-9773076",
"CSAFPID-9773077",
"CSAFPID-9773078",
"CSAFPID-9773079",
"CSAFPID-9773080",
"CSAFPID-9773081",
"CSAFPID-9773082"
],
"known_not_affected": [
"CSAFPID-8476867",
"CSAFPID-1409455"
]
},
"references": [
{
"category": "external",
"summary": "Source - nvd",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101906"
},
{
"category": "external",
"summary": "Source - ncscclear",
"url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101906"
},
{
"category": "external",
"summary": "Source - cveprojectv5",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101906"
},
{
"category": "external",
"summary": "Source - redhat",
"url": "https://access.redhat.com/security/cve/CVE-2026-101906"
},
{
"category": "external",
"summary": "Source - debian",
"url": "https://security-tracker.debian.org/tracker/CVE-2026-101906"
},
{
"category": "external",
"summary": "Source - first",
"url": "https://api.first.org/data/v1/epss"
},
{
"category": "external",
"summary": "Source - github",
"url": "https://github.com/advisories/GHSA-mghh-pgcx-3jjj"
},
{
"category": "external",
"summary": "Source - osv",
"url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101906.json?alt=media"
},
{
"category": "external",
"summary": "Source - osv",
"url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-mghh-pgcx-3jjj.json?alt=media"
},
{
"category": "external",
"summary": "Source - certbundde",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4056.json"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/pull/11141"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/releases/tag/v1.20.0"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj"
},
{
"category": "external",
"summary": "Reference - redhat",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101906"
},
{
"category": "external",
"summary": "Reference - github; osv; redhat",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101906"
},
{
"category": "external",
"summary": "Reference - github",
"url": "https://github.com/advisories/GHSA-mghh-pgcx-3jjj"
},
{
"category": "external",
"summary": "Reference - osv",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101906.json"
},
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4056.json"
},
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4056"
},
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://confluence.atlassian.com/security/security-bulletin-october-20-2026-1874690162.html"
}
],
"scores": [
{
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"products": [
"CSAFPID-6014972",
"CSAFPID-8580141",
"CSAFPID-8580142",
"CSAFPID-8583063",
"CSAFPID-8902830",
"CSAFPID-8902831",
"CSAFPID-8925638",
"CSAFPID-8925639",
"CSAFPID-8925641",
"CSAFPID-9053231",
"CSAFPID-9482813",
"CSAFPID-9484961",
"CSAFPID-9484962",
"CSAFPID-9484963",
"CSAFPID-9527307",
"CSAFPID-9527315",
"CSAFPID-9527321",
"CSAFPID-9773074",
"CSAFPID-9773075",
"CSAFPID-9773076",
"CSAFPID-9773077",
"CSAFPID-9773078",
"CSAFPID-9773079",
"CSAFPID-9773080",
"CSAFPID-9773081",
"CSAFPID-9773082"
]
}
],
"title": "CVE-2026-101906"
}
]
}