Description
axios is vulnerable to Inefficient Regular Expression Complexity
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios/axios | unspecified – ≤ 0.21.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 0.21.3+dfsg-1 | — |
| Debian 13 | node-axios | 0.21.3+dfsg-1 | — |
| Debian 12 | node-axios | 0.21.3+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-axios | No fix yet | — |
| Ubuntu 25.10 | node-axios | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 2 | kiali | v1.24.7.redhat1-1.el8 | RHSA-2022:1276 |
| Red Hat Service Mesh 2 | servicemesh +6 | 2.0.9-3.el8 | RHSA-2022:1276 |
| Red Hat Service Mesh 2 | servicemesh-prometheus | 2.14.0-16.el8.1 | RHSA-2022:1276 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
T-Guerrero/axios-redos ★ 0 · Jun 12, 2022
Axios Redos (CVE-2021-3749) proof of concept
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | < 0.21.2 | 0.21.2 | GHSA-cph5-m8f7-6c5x |
Advisories 5
- RHSA-2022:1276 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- ICSA-24-277-02 Subnet Solutions Inc. PowerSYSTEM Center CISA ICS & IT advisories · Oct 1, 2024
- WID-SEC-2022-0970 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2024
- ICSA-22-258-05 Siemens SINEC INS CISA ICS & IT advisories · Sep 13, 2022
- SSA-637483 SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 Siemens ProductCERT · Sep 13, 2022
References
- https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
- https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
- [druid-commits] 20211008 [GitHub] [druid] andreacyc closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211008 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211008 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211009 [GitHub] [druid] jihoonson closed pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211009 [GitHub] [druid] andreacyc opened a new pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211009 [druid] branch master updated: Fix CVE-2021-3749 reported in security vulnerabilities job (#11786) mailing-list
- [druid-commits] 20211009 [GitHub] [druid] jihoonson commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211009 [GitHub] [druid] jihoonson merged pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-commits] 20211009 [GitHub] [druid] andreacyc commented on pull request #11786: Fix CVE-2021-3749 reported in security vulnerabilities job mailing-list
- [druid-dev] 20211009 [CRON] Passed: apache/druid#33528 (master - adb2237) mailing-list
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf