Axios is vulnerable to DoS attack through lack of data size check

Description

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.28.0, < 0.30.2

  >= 1.0.0, < 1.12.0**

• Patched version(s): **0.30.2

  1.12.0**

References

• GHSA-4hjh-wcwx-xvwj
• CVE-2025-58754
• CWE-770
• CAPEC-310
• OWASP 2021-A6