Skip to main content

Axios CVE-2026-44488

| EUVDEUVD-2026-36261 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-06-04 https://github.com/axios/axios GHSA-777c-7fjr-54vf
Denial Of Service Node.js
7.5
CVSS 3.1 · Vendor: https://github.com/axios/axios
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify server using axios fetch adapter
  2. Delivery
    Supply oversized body or data: URL
  3. Exploit
    Bypass unenforced maxBodyLength/maxContentLength
  4. Execution
    Axios buffers full payload via fetch()
  5. Persist
    Memory/CPU/socket exhaustion
  6. Impact
    Service degradation or outage

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target application to (1) use axios versions 1.7.0 through 1.15.x, (2) route the request through the fetch adapter - either explicitly via adapter: 'fetch', via an adapter array where fetch is selected, via env.fetch, or by running in an environment without xhr/http - and (3) have configured a finite maxContentLength and/or maxBodyLength that the application trusts as a security boundary. The attacker must additionally control one of: a response body returned to the axios client, a data: URL passed as the request target, or a request body that the application forwards through axios. Limiting factors: applications using the default unlimited (-1) limits are not exposed because no enforcement is expected; the Node http adapter path is unaffected; and browser-side use is bounded by the browser process so it does not translate to server resource exhaustion.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High) and reflects an availability-only impact reachable over the network without authentication or user interaction - consistent with classic DoS. EPSS, KEV, and SSVC values were not provided in the input, so probability of exploitation in the wild is not independently quantified; treat this as a hardening fix rather than an emergency patch. The realistic risk is narrower than the score suggests because the issue only manifests when an application explicitly sets a finite maxContentLength or maxBodyLength and uses the fetch adapter - default Axios configurations (-1, unlimited) and the Node http adapter are unaffected. Server-side workloads forwarding attacker-controlled bodies, fetching from untrusted upstreams, or resolving data: URLs are the meaningful exposure; browser usage is naturally bounded by the host browser and should not be modeled as server-process exhaustion.
Exploit ScenarioDerived

A server-side Node.js service uses axios with adapter: 'fetch' and maxBodyLength: 1024 to proxy user-supplied payloads to an upstream API; an attacker submits a 2 MiB body which axios forwards in full, ballooning memory and socket buffers until the process or upstream degrades. The advisory ships a working proof-of-concept demonstrating both an oversized POST and a 4 KiB data: URL bypassing maxContentLength: 16, so weaponization cost is minimal for any reachable endpoint that exposes the misconfiguration.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 04, 2026

Denial-of-service via size-limit bypass in Axios 1.7.0 through 1.15.x affects server-side Node.js applications that select the fetch adapter and rely on maxContentLength or maxBodyLength as a security boundary. Attackers controlling response bodies, data: URLs, or forwarded request payloads can exhaust memory, CPU, or network resources because the fetch adapter never reads those limits. No public exploit identified at time of analysis beyond the advisory's own proof-of-concept code.

RemediationAI

Vendor-released patch: upgrade axios to 1.16.0 or later, which lands the fixes from PRs https://github.com/axios/axios/pull/10795 and https://github.com/axios/axios/pull/10796 adding data: URL decoded-size checks, outbound body-size checks, Content-Length pre-checks, streaming enforcement, and a non-streaming fallback. If immediate upgrade is not possible, switch server-side requests where size limits are security-relevant from the fetch adapter to the Node http adapter (adapter: 'http'), which already enforces both limits; the trade-off is losing fetch-specific behavior and any reliance on platform fetch semantics. As compensating controls, validate or hard-cap attacker-controlled request bodies before passing them to axios, and reject or strictly allowlist URL schemes - particularly data: - before issuing requests, accepting that allowlisting may break legitimate use of inline payloads. Track the advisory at https://github.com/advisories/GHSA-777c-7fjr-54vf for any follow-up backports.

Affected VersionsENISA

axios 1.7.0, < 1.16.0

Affected Packages

npm axios fix: 1.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Axios is a widely used HTTP client distributed as the npm package axios (pkg:npm/axios). It ships multiple transport adapters - xhr for browsers, http for Node.js, and a newer fetch adapter that uses the platform fetch() API. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): in lib/adapters/fetch.js, the request config was destructured without maxContentLength or maxBodyLength, so the adapter dispatched fetch() and then materialized responses via text()/arrayBuffer()/blob() without comparing against the configured caps. The companion http adapter has always enforced these limits, so the divergence between adapters is what makes the boundary unsound when applications opt into fetch.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/axios/axios) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (https://github.com/axios/axios).

CVSS VectorVendor: https://github.com/axios/axios

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Summary

Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured.

This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary.

Impact

The impact is availability-only. Affected applications may process, buffer, or transmit data beyond the configured limit, potentially exhausting memory, CPU, or network resources.

This does not affect axios’s default unlimited behaviour by itself: maxContentLength and maxBodyLength default to -1. The vulnerability exists when an application has configured finite limits and expects axios to enforce them.

Server-side runtimes are the primary concern. Browser impact is generally constrained by the browser process and browser fetch behavior, and should not be described as server process exhaustion.

Affected Functionality

Affected functionality includes requests using the built-in fetch adapter with finite maxContentLength or maxBodyLength values.

Relevant configurations include:

  • adapter: 'fetch'
  • adapter: ['fetch', ...] when fetch is selected
  • environments where neither xhr nor http is available and axios falls back to fetch
  • custom fetch environments configured through env.fetch

Unaffected functionality includes:

  • Node.js default http adapter enforcement
  • versions before the fetch adapter was introduced
  • configurations that do not rely on finite axios size limits

Technical Details

In vulnerable versions, lib/adapters/fetch.js destructured request config without maxContentLength or maxBodyLength. The adapter dispatched fetch() and then materialized the response through text(), arrayBuffer(), blob(), or related resolvers without checking the configured response limit.

The fix in e5540dc added:

  • maxContentLength and maxBodyLength reads in lib/adapters/fetch.js
  • upfront data: URL decoded-size checks
  • outbound body-size checks before dispatch
  • Content-Length response pre-checks
  • streaming response enforcement
  • fallback checks for environments without ReadableStream
  • regression tests in tests/unit/adapters/fetch.test.js

Proof of Concept of Attack

js
import http from 'node:http';
import axios from 'axios';

const server = http.createServer((req, res) => {
  let received = 0;

  req.on('data', chunk => {
    received += chunk.length;
  });

  req.on('end', () => {
    res.end(JSON.stringify({ received }));
  });
});

await new Promise(resolve => server.listen(0, resolve));
const url = `http://127.0.0.1:${server.address().port}/`;

await axios.post(url, 'A'.repeat(2 * 1024 * 1024), {
  adapter: 'fetch',
  maxBodyLength: 1024
});

// Vulnerable versions succeed and the server receives 2097152 bytes.
// Fixed versions reject with ERR_BAD_REQUEST.

server.close();

Workarounds

Use the Node.js http adapter for server-side requests where finite size limits are security-relevant.

Validate or cap attacker-controlled request bodies before passing them to axios.

Reject or strictly allowlist attacker-controlled URL schemes, especially data: URLs, before calling axios.

<details> <summary>Original Report</summary>

Summary

When Axios is used with adapter: 'fetch', configured body/response size limits are not enforced. This allows oversized uploads/downloads (including data: URLs) despite explicit limits, which can lead to memory/resource exhaustion in server-side usage.

Details

maxBodyLength and maxContentLength are not applied in the fetch adapter flow:

  • lib/adapters/fetch.js (146-160): config destructuring does not include these controls.
  • lib/adapters/fetch.js (220-234): request is dispatched with fetch() without request-size enforcement.
  • lib/adapters/fetch.js (267-283): response is materialized via text(), arrayBuffer(), blob(), etc. without response-size checks.

By contrast, the HTTP adapter enforces both limits.

PoC

Environment:

  • Axios main at commit f7a4ee2
  • Node v24.2.0

Steps:

  1. Start an HTTP server that counts received bytes and echoes {received}.
  2. Send 2 MiB with:
  • adapter: 'fetch'
  • maxBodyLength: 1024
  1. Request a 4 KiB data: URL with:
  • adapter: 'fetch'
  • maxContentLength: 16

Expected secure behavior: both requests rejected. Observed:

  • Upload: success, server received 2097152
  • data: response: success, length 4096

Impact

Type: DoS / resource exhaustion due to limit bypass. Impacted: applications using Axios fetch adapter as a server-side security control boundary for untrusted request/response sizes. </details>

---

Executive ViewAI

Why It Matters

Axios HTTP client library versions 1.7.0 through 1.15.x contain a denial-of-service vulnerability in the fetch adapter that bypasses configured size limits intended to protect against resource exhaustion. Server-side Node.js applications relying on maxContentLength or maxBodyLength controls are exposed to memory and CPU exhaustion attacks, risking application crashes and service unavailability. Organizations running these versions should prioritize patching to prevent production incidents.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2024-35286 CRITICAL POC
9.8 Oct 21

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

References

Advisories & patches
PATCH https://github.com/axios/axios/pull/10795 PATCH https://github.com/axios/axios/pull/10796 ADVISORY https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf ADVISORY https://vuldb.com/vuln/370400 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:27044 REF https://access.redhat.com/errata/RHSA-2026:27063 REF https://access.redhat.com/errata/RHSA-2026:28964 REF https://access.redhat.com/errata/RHSA-2026:29082 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30650 REF https://access.redhat.com/errata/RHSA-2026:30651 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34160 REF https://access.redhat.com/errata/RHSA-2026:34374 REF https://access.redhat.com/errata/RHSA-2026:34525 REF https://access.redhat.com/errata/RHSA-2026:34527 REF https://access.redhat.com/errata/RHSA-2026:34530 REF https://access.redhat.com/errata/RHSA-2026:36611 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:36883 REF https://access.redhat.com/errata/RHSA-2026:40119 REF https://access.redhat.com/errata/RHSA-2026:40138 REF https://access.redhat.com/errata/RHSA-2026:40262 REF https://access.redhat.com/errata/RHSA-2026:40768 REF https://access.redhat.com/errata/RHSA-2026:40792 REF https://access.redhat.com/errata/RHSA-2026:40795 REF https://access.redhat.com/errata/RHSA-2026:41031 REF https://access.redhat.com/errata/RHSA-2026:41055 REF https://access.redhat.com/errata/RHSA-2026:41064 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42085 REF https://access.redhat.com/errata/RHSA-2026:42142 REF https://access.redhat.com/errata/RHSA-2026:42146 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:43052 REF https://access.redhat.com/errata/RHSA-2026:46885 REF https://access.redhat.com/errata/RHSA-2026:46903 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:54188 REF https://access.redhat.com/errata/RHSA-2026:54555 REF https://access.redhat.com/errata/RHSA-2026:57191 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-44488 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487949 REF https://github.com/advisories/GHSA-777c-7fjr-54vf REF https://github.com/axios/axios/releases/tag/v1.16.0 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44488.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy