IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Publicada: (hace 5 meses)

Descripción

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.

Debilidad (CWE): CWE-400CWE-1333

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
acm 2.11 —
acm 2.13 —
acm 2.14 —
acm 2.15 —
acm 2.16 —
advanced cluster security 4.10 —
advanced cluster security 4.9 —
ansible automation platform 2.5 —
ansible automation platform 2.7 —
axios axios >= 1.0.0, < 1.16.0, < 0.32.0
discovery 2 —
migration toolkit applications 8.1 —
multicluster engine 2.10 —
multicluster engine 2.6 —
multicluster engine 2.8 —
multicluster engine 2.9 —
openshift 4.12 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
openshift ai 3.4 —
openshift devspaces 3.29 —
quay 3.10 —
quay 3.12 —
quay 3.15 —
quay 3.16 —
quay 3.9 —
Red Hat Cryostat 4 —
Red Hat Gatekeeper 3 —
Red Hat Migration Toolkit for Applications 8 —
Red Hat multicluster engine for Kubernetes 2.1 all versions
Red Hat multicluster engine for Kubernetes 2.6 all versions
Red Hat multicluster engine for Kubernetes 2.8 all versions
Red Hat multicluster engine for Kubernetes 2.9 all versions
Red Hat Network Observability Operator —
Red Hat OpenShift Pipelines all versions
Red Hat OpenShift Service Mesh 3 —
Red Hat Red Hat 3scale API Management Platform 2 —
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 all versions
Red Hat Red Hat Advanced Cluster Security 4.9 all versions
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 all versions
Red Hat Red Hat AMQ Broker 7.13.6 —
Red Hat Red Hat AMQ Broker 7.14.1 —
Red Hat Red Hat Ansible Automation Platform 2 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.7 all versions
Red Hat Red Hat build of Apache Camel for Spring Boot 4 —
Red Hat Red Hat build of Apache Camel - HawtIO 4 all versions
Red Hat Red Hat build of Apicurio Registry 3.3.1 all versions
Red Hat Red Hat Data Grid 8.6.2 —
Red Hat Red Hat Developer Hub 1.10 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Discovery 2 all versions
Red Hat Red Hat Migration Toolkit 1.8 all versions
Red Hat Red Hat Migration Toolkit for Applications 8.1 all versions
Red Hat Red Hat OpenShift AI 3.4 all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
Red Hat Red Hat OpenShift Container Platform 4.21 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.29 all versions
Red Hat Red Hat OpenShift Service Mesh 2.6 all versions
Red Hat Red Hat OpenShift Service Mesh 3.0 all versions
Red Hat Red Hat OpenShift Service Mesh 3.1 all versions
Red Hat Red Hat OpenShift Service Mesh 3.2 all versions
Red Hat Red Hat OpenShift Service Mesh 3.3 all versions
Red Hat Red Hat Quay 3.10 all versions
Red Hat Red Hat Quay 3.12 all versions
Red Hat Red Hat Quay 3.15 all versions
Red Hat Red Hat Quay 3.16 all versions
Red Hat Red Hat Quay 3.9 all versions
Red Hat Red Hat Trusted Artifact Signer 1.3 all versions
rhdh 1.10 —
rhdh 1.9 —
rhmt 1.8 —
service mesh 2.6 —
service mesh 3.0 —
service mesh 3.1 —
service mesh 3.2 —
service mesh 3.3 —
trusted artifact signer 1.3 —

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* < 0.32.0
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* ≥ 1.0.0 < 1.16.0