CVE-2025-58754: Axios is vulnerable to DoS attack through lack of data size check
(updated )
When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.
References
- github.com/advisories/GHSA-4hjh-wcwx-xvwj
- github.com/axios/axios
- github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
- github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67
- github.com/axios/axios/commit/c30252f685e8f4326722de84923fcbc8cf557f06
- github.com/axios/axios/pull/7011
- github.com/axios/axios/pull/7034
- github.com/axios/axios/releases/tag/v0.30.2
- github.com/axios/axios/releases/tag/v1.12.0
- github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
- nvd.nist.gov/vuln/detail/CVE-2025-58754
Code Behaviors & Features
Detect and mitigate CVE-2025-58754 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →