EUVD-2026-25602
GHSA-vf2m-468p-8v99
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNetwork attacker sends HTTP request
-
DeliveryAxios stream handler bypasses maxContentLength check
-
ExploitUnbounded response stream returned to application
-
ExecutionApplication consumes entire stream into memory
-
ImpactMemory exhaustion causes denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to explicitly set responseType: 'stream' when making HTTP requests with Axios. The application must also have configured maxContentLength (or rely on the default limit). Default Axios configurations without explicit stream handling are NOT vulnerable. The attack is triggered by network-accessible HTTP requests sent to the application, with no authentication barriers. The vulnerability applies equally to both Node.js and browser environments that use the stream response type. |
| Impact | CVSS 5.3 with AV:N/AC:L/PR:N/UI:N indicates network-accessible denial of service with low attack complexity and no privilege or interaction requirements. However, the practical impact is LIMITED to availability only (A:L), and the attack requires the target application to explicitly configure responseType: 'stream' - a non-default setting. The vulnerability does NOT enable code execution, authentication bypass, or data disclosure. EPSS score and KEV status were not provided in input data, preventing assessment of real-world exploitation prevalence. The threat is primarily relevant to Node.js applications and server-side contexts where unbounded stream consumption could exhaust memory or connection resources. Browser-based applications are lower risk due to browser memory constraints and same-origin policy. Organizations running default Axios configurations are not affected. |
| Exploit ScenarioDerived | An attacker crafts an HTTP request to a vulnerable application configured with Axios responseType: 'stream' and a maxContentLength limit (e.g., 10MB). The attacker's server sends an HTTP response with a Content-Length header claiming a small size (1MB) but streams gigabytes of data. Since Axios does not enforce maxContentLength on streams, the application consumes the entire stream, exhausting server memory and causing denial of service. No authentication or special client behavior is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 24, 2026
Axios HTTP client prior to version 1.15.1 (1.x branch) and 0.31.1 (0.x branch) fails to enforce maxContentLength limits when responseType is set to 'stream', allowing attackers to cause denial of service by streaming unbounded response payloads that bypass configured size restrictions. The vulnerability affects both browser and Node.js environments and requires no authentication or user interaction to exploit.
RemediationAI
Upgrade to Axios 1.15.1 or later for the 1.x branch, or to 0.31.1 or later for the 0.x branch. These versions restore maxContentLength enforcement for stream responses. If immediate upgrade is not feasible, implement application-level stream consumption limits by wrapping the Axios stream response with a bytes-read counter and abort the stream if cumulative bytes exceed your configured maxContentLength threshold. Alternatively, avoid using responseType: 'stream' unless absolutely required; use the default response type which respects maxContentLength. This workaround has the trade-off of loading entire responses into memory before returning them, increasing memory footprint. See GitHub security advisory GHSA-vf2m-468p-8v99 for additional context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Axios is a promise-based HTTP client library that provides a maxContentLength configuration option intended to limit the size of HTTP responses. When responseType is configured as 'stream', Axios returns the underlying HTTP response stream object directly to the caller. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling) - the stream response path does not validate response size against the maxContentLength setting before returning the stream, allowing consuming code to receive unbounded data. This affects both browser XMLHttpRequest-based streams and Node.js stream implementations. The CPE indicates all Axios versions before the fix are vulnerable.
Know when Axios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
Exploit-DB