← back
CVE-2021-3749

Inefficient Regular Expression Complexity in axios/axios

CVSS 7.5 HIGHEPSS 8.5%CWE-1333
In short

The axios library contains a regex pattern that becomes very slow when processing certain types of input, allowing attackers to cause performance problems or denial of service by sending specially crafted requests.

Technical detail

axios contains an inefficient regular expression (ReDoS vulnerability) in URL parsing that exhibits exponential backtracking on malformed input. An attacker can exploit this by providing a specially crafted URL string, causing the application to hang or consume excessive CPU resources without requiring authentication.

Summary generated and translated by AI from the official description.
axios is vulnerable to Inefficient Regular Expression Complexity
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
axios · axios/axios

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →