CVE-2026-101903

{
  "etk_id": "ETK-2026-66",
  "cve_id": "CVE-2026-101903",
  "display_id": "CVE-2026-101903",
  "ghsa_id": "GHSA-c29m-xwm3-cm6r",
  "euvd_id": "EUVD-2026-88378",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Axios Node.js data URL regex denial of service",
  "summary": "Axios versions before 1.20.0 can consume excessive synchronous CPU while parsing malformed data: URLs in the Node.js HTTP adapter. An attacker may delay the Node.js event loop and disrupt service when the application forwards untrusted URL input to Axios without blocking or constraining data: URLs.",
  "mitigation": "Upgrade axios to version 1.20.0 or later. Until upgraded, reject data: URLs from untrusted input and impose a strict URL-length limit before calling Axios.",
  "vendor": "npm",
  "product": "npm:axios",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.16.1, < 1.20.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.20.0"
      ],
      "package_name": "axios",
      "purl": "pkg:npm/axios"
    }
  ],
  "cwes": [
    1333
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0038,
  "epss_percentile": 0.3085,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 15.718795133333334,
  "t0_at": "2026-09-28T17:25:04.448000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T23:57:06.571582+00:00",
      "days": 14.272246800717593,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T17:25:04.448000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-09-30T15:03:21+00:00",
      "days": 1.901580462962963,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T17:25:04.448000+00:00",
      "url": "https://github.com/advisories/GHSA-c29m-xwm3-cm6r"
    },
    "trigger_signal": {
      "at": "2026-09-28T17:25:04.448000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T17:25:04.448000+00:00",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r"
    }
  }
}