Allocation of Resources Without Limits or Throttling in Axios

Description

Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

Affected version(s): >= 1.7.0, < 1.16.0
Patched version(s): 1.16.0

References

GHSA-777c-7fjr-54vf
CVE-2026-44488
CWE-770
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Allocation of Resources Without Limits or Throttling in Axios and gives you actionable findings to investigate.

Start a free scan

Related Issues

Allocation of Resources Without Limits or Throttling in vriteio/vrite - CVE-2023-5573
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning - CVE-2026-45134
Axios HTTP/2 Session Cleanup State Corruption Vulnerability - CVE-2026-39865
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams - CVE-2026-42040

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated June 12, 2026