Denial of Service in axios

Description

Versions of axios prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the maxContentLength property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.18.0
• Patched version(s): 0.18.1

References

• GHSA-42xw-2xvc-qx8m
• app.snyk.io
• snyk.io
• www.npmjs.com
• CVE-2019-10742
• CWE-20
• CWE-755
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in remarkable - CVE-2019-12041
• Regular Expression Denial of Service (ReDoS) in lodash - lodash - CVE-2019-1010266
• Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - GHSA-x5rq-j2xg-h7qm - CVE-2019-1010266
• Regular Expression Denial of Service (ReDoS) in lodash - lodash-amd - CVE-2019-1010266

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

axios