Inefficient Regular Expression Complexity in axios/axios
Priority MEDIUM 44CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
axios is vulnerable to Inefficient Regular Expression Complexity
Why it matters now
EPSS 0.08515 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (npm): 0.21.2Red Hat: 5 advisoriesRed Hat: 5 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| axios | axios/axios | up to 0.21.1 | — | No fix listed | CNA |
| — | axios (npm) | before 0.21.2 | 0.21.2 | Patch available | GHSA-cph5-m8f7-6c5x |
- axios/axios Vendoraxios Affected up to 0.21.1 Fixed in — No fix listed CNA
- axios (npm) Vendor— Affected before 0.21.2 Fixed in 0.21.2 Patch available GHSA-cph5-m8f7-6c5x
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* | up to 0.21.1 | Vulnerable | axios |
| cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* | before 1.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* | 1.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* | 1.0 sp1 | Vulnerable | Siemens |
| cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:* | 21.1 to before 21.7.0.0.0 | Vulnerable | Oracle |
- cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions up to 0.21.1 Vulnerable ·axios
- cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
- cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:* Versions 21.1 to before 21.7.0.0.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-cph5-m8f7-6c5x axios (npm) Fixed in 0.21.2 Advisory →
Red Hat 5 advisories
- RHSA-2022:1276 Released 2022-04-07 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.0.9 security update
- OpenShift Service Mesh 2.0 kiali-v1.24.7.redhat1-1.el8, servicemesh-2.0.9-3.el8, servicemesh-istioctl-2.0.9-3.el8 +6
- RHSA-2022:0056 Released 2022-03-10 · Red Hat rating ModerateOpenShift Container Platform 4.10.3 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2021:4902 Released 2021-12-01 · Red Hat rating ModerateACS 3.67 security and enhancement update
- RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator
Show 2 more Red Hat advisories
- RHSA-2021:4618 Released 2021-11-11 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.4 images and security updates
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
- RHSA-2021:3694 Released 2021-09-29 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.6.0 security & bugfix update
- 8Base-RHMTC-1.6 rhmtc/openshift-migration-ui-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Service Telemetry Framework 1.2 for RHEL 8 | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.2 | Fixed | — |
| 8Base-RHMTC-1.6 | Fixed | RHSA-2021:3694 |
| OpenShift Service Mesh 2.0 | Fixed | RHSA-2022:1276 |
| RHACS 3.67 for RHEL 8 | Fixed | RHSA-2021:4902 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2022:0056 |
Not affected: 6 products
- 8Base-MTV-2.2
- 8Base-RHMTC-1.6
- OpenShift Service Mesh 2.0
- RHACS 3.67 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4.10
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3749
- 2026-10-03 Alias added: GHSA-cph5-m8f7-6c5x
- 2026-10-20 EPSS moved to the 95th–99th percentile
References
Advisory 3
Other 22
- [druid-commits] 20211008 [GitHub] [druid] andreacyc closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211008 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211008 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211009 [GitHub] [druid] jihoonson closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211009 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211009 [druid] branch master updated: Fix CVE-2021-3749 reported in security vulnerabilities job (#11786)
- [druid-commits] 20211009 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211009 [GitHub] [druid] jihoonson merged pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-commits] 20211009 [GitHub] [druid] andreacyc commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job
- [druid-dev] 20211009 [CRON] Passed: apache/druid#33528 (master - adb2237)
- https://www.npmjs.com/package/axios
- https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@%3Ccommits.druid.apache.org%3E
- https://github.com/axios/axios
More Axios vulnerabilities
- TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
- TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
- TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
- TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
- TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
- TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
Sources
- CVE-2021-3749 · CVE Program
- CVE-2021-3749 · NVD
- FIRST EPSS
- GHSA-cph5-m8f7-6c5x · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3749 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences