Axios is vulnerable to DoS attack through lack of data size check

Description

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.28.0, < 0.30.2

  >= 1.0.0, < 1.12.0**

• Patched version(s): **0.30.2

  1.12.0**

References

• GHSA-4hjh-wcwx-xvwj
• CVE-2025-58754
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
• BrowserStack Local vulnerable to Command Injection through logfile variable - CVE-2025-57283
• Strapi core vulnerable to sensitive data exposure via CORS misconfiguration - CVE-2025-53092
• Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Is your robots.txt file vulnerable? Here's how to check and secure it

Update Cheat Sheet for Developers

Tags:

npm

axios