CyberRota Analysis
AI-GeneratedThe vulnerability affects the Axios HTTP client for Java and allows attackers to craft malformed data URLs that exploit excessive backtracking in the JavaScript regular expression engine, leading to potential denial of service by blocking the Node.js event loop. Organizations using Axios versions 1.16.1 through 1.20.0 should prioritize patching to version 1.20.0 to mitigate this high-severity risk. This is particularly critical for applications relying on Node.js for handling HTTP requests.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.