← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2021-3749 · published 31 August 2021
CVE-2021-3749: Axios inefficient regular expression (redos) vulnerability
Axios · Axios
axios is vulnerable to Inefficient Regular Expression Complexity
7.5 CVSS 3.1 High EPSS 8.5% · top 5.1% CWE-1333 · Inefficient regular expression (ReDoS)CWE-400 · Uncontrolled resource consumption
7.5CVSS 3.1 base score, v2 7.8
8.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
28References, 2 tagged exploit
17 Jun 2026Last modified by NVD
Description
axios is vulnerable to Inefficient Regular Expression Complexity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-3749 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10.0CVE-2026-42043Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axio…EPSS 0.58%10.0CVE-2018-2913Oracle goldengate out-of-bounds write vulnerabilityVulnerability in the Oracle GoldenGate component of Oracle GoldenGate (subcomponent: Monitoring Manager). Supported versions that are affected are 12…EPSS 4.2%10.0CVE-2016-0452Oracle goldengate vulnerabilityUnspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, …EPSS 5.9%10.0CVE-2016-0451Oracle goldengate vulnerabilityUnspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, …EPSS 6.8%9.8CVE-2024-57965Axios origin validation error vulnerabilityIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribu…EPSS 0.38%9.8CVE-2023-48427Siemens sinec ins improper certificate validation vulnerabilityA vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of th…EPSS 0.38%9.8CVE-2017-5645Apache Log4j 2 socket server deserialization allows remote code executionApache Log4j 2.x before 2.8.2 deserializes binary log events received over its TCP or UDP socket server without validating the payload. A crafted ser…EPSS 90%analysed
Source: NIST National Vulnerability Database (record CVE-2021-3749), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.
