Axios EUVD-2026-25601

The vulnerability requires two specific conditions to be active: (1) maxRedirects must be set to 0 in the Axios request configuration, and (2) the request body must be a stream (not a string or buffer). Default Axios configurations set maxRedirects to 5, so applications using default settings are not vulnerable. The native http/https transport is used by default in Node.js; browser environments using XMLHttpRequest or fetch adapters are not affected. The attacker must be able to send network requests to the application (AV:N confirms unauthenticated network access), but the target application must be explicitly configured with both maxRedirects=0 AND a maxBodyLength limit. Applications that do not enforce maxBodyLength or do not use stream bodies are also not vulnerable, as the bypass specifically affects the interaction between maxRedirects=0 and stream body handling.

This is a moderate-severity denial of service vulnerability with practical real-world risk. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates network-accessible, unauthenticated exploitation with low attack complexity, but impact is limited to availability (denial of service). The vulnerability requires a specific configuration condition (maxRedirects=0) which is not the default behavior, reducing widespread exposure. No EPSS score or KEV status provided in the data, and no POC is confirmed to exist in public sources at the time of analysis. The exploitation condition is straightforward: an attacker crafts a request with a stream body while the application uses maxRedirects=0, bypassing the enforced body size limit. This is not an arbitrary code execution issue but rather a resource exhaustion vector. Organizations using Axios as an HTTP client library (common in Node.js servers) and implementing body size limits for security should prioritize patching, but this is not a critical emergency unless the application is already experiencing resource exhaustion attacks.

An attacker identifies a Node.js application using Axios with maxBodyLength configured to a strict limit (e.g., 10MB) and maxRedirects set to 0. The attacker sends a crafted HTTP POST or PUT request containing a stream body larger than the configured limit (e.g., 100MB). Because maxRedirects is 0, the native http/https transport path fails to enforce the maxBodyLength check, and the oversized stream is sent in full to the server, consuming memory and bandwidth and potentially causing the application to slow down, crash, or become unresponsive to legitimate requests.