axios : Uncontrolled Resource Consumption Vulnerability - CVE-2026-101906

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0 Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured NO_PROXY or no_proxy is non-empty redirects are followed and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/./ ) backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expr