Axios is vulnerable to DoS attack through lack of data size check

Description

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.28.0, < 0.30.2

  >= 1.0.0, < 1.12.0**

• Patched version(s): **0.30.2

  1.12.0**

References

• GHSA-4hjh-wcwx-xvwj
• CVE-2025-58754
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• DiracX-Web is vulnerable to attack through an Open Redirect on its login page - CVE-2025-54066
• x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting - CVE-2022-25646
• Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity - CVE-2025-58451
• Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data - CVE-2025-47204

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Is your robots.txt file vulnerable? Here's how to check and secure it

Update Cheat Sheet for Developers

Tags:

npm

axios