CVE-2026-101906

Axios is a tool many websites and apps use behind the scenes to send and receive data over the internet. This bug lets an attacker send a specially crafted web address that makes the server get stuck doing an enormous amount of unnecessary work — like a cashier who gets handed a receipt with thousands of tiny items to scan one by one, grinding the whole checkout line to a halt. The result is the app or site becomes slow or unresponsive, not that data gets stolen.

This matters to you if your website, app, or backend service uses the Axios library to make HTTP requests. It only matters if your setup is configured with an HTTP_PROXY or HTTPS_PROXY and also has a non-empty NO_PROXY exception list — if you don't use a proxy this way, this particular issue doesn't apply to you.

This is getting sustained attention in security reporting and has been linked to the ShinyHunters threat actor group, which raises real concern even though no confirmed in-the-wild attacks or public exploit code exist yet. Given this level of attention from a known malicious actor group, this should be treated as a high-priority fix rather than something to defer. Don't wait for a confirmed attack before patching.

Confirm exposure by checking: (1) your application's package manifest for an axios dependency between 1.15.0 and 1.20.0 (inclusive-exclusive of fix), and (2) whether HTTP_PROXY/HTTPS_PROXY environment variables are set alongside a non-empty NO_PROXY/no_proxy value, with redirect-following enabled. If all three conditions hold, an attacker-controlled redirect Location header with a crafted trailing-dot hostname can trigger quadratic backtracking in the shouldBypassProxy regex, blocking Node.js's single event loop. Upgrade axios to 1.20.0 or later across all affected branches (no patch information is currently published beyond this fixed version, so verify changelog/release notes directly from the axios project before deploying). There is no documented breaking change tied to this specific fix. If an immediate upgrade isn't feasible, mitigate by disabling proxy usage, sanitizing/capping redirect Location header length before processing, or disallowing automatic redirect-following for untrusted upstream hosts. Not in CISA KEV, so no federal remediation deadline applies. Monitor application logs and process CPU/event-loop latency metrics for anomalous spikes correlated with inbound redirect responses as an indicator of attempted exploitation.

CWE-400 (Uncontrolled Resource Consumption) / CWE-1333 (Inefficient Regular Expression Complexity) in axios's shouldBypassProxy host normalization (versions 1.15.0–1.20.0, fixed in 1.20.0). Attack vector requires network-reachable redirect responses under attacker influence, combined with proxy configuration (HTTP_PROXY/HTTPS_PROXY plus non-empty NO_PROXY) and redirect-following enabled; a crafted Location header with many dots followed by a non-dot character triggers quadratic backtracking in a trailing-dot regex, blocking Node.js's event loop. Not listed in CISA KEV; no public exploit code is known; predicted exploitation likelihood is low per EPSS with a flat trend. However, sustained press/roundup coverage associates this CVE with the ShinyHunters threat actor group, elevating practical risk assessment beyond what EPSS alone would suggest. Exploit maturity: theoretical/PoC-level denial-of-service, no confirmed weaponization reported.