Skip to content
OpenAdvisories
High · 7.5 CVE-2025-58754 EUVD-2025-28992GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

Published Sep 12, 2025 · Updated Jan 16, 2026 · Assigned by GitHub_M

Vendor: axios Product: axios Package: axios Package: grafana-image-renderer Package: jitsucom-jitsu Package: jitsucom-jitsu-console Package: jitsucom-jitsu-rotor Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kubeflow-centraldashboard Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: lerna Package: node-axios Package: node-axios Package: opensearch-dashboards-3 Package: prism Package: saf Package: tileserver-gl Package: tileserver-gl-compat Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.

Affected products

VendorProductAffectedFixed
axios axios >= 1.0.0, < 1.12.0, >= 0.28.0, < 0.30.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-axios 1.12.1+dfsg-1 —
Debian 13 node-axios No fix yet —
Debian 12 node-axios No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 node-axios No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS node-axios No fix yet —
Ubuntu Pro 24.04 LTS node-axios No fix yet —
Ubuntu Pro 22.04 LTS node-axios No fix yet —
Ubuntu Pro 20.04 LTS node-axios No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ansible Automation Platform Inside 2 ansible-builder 3.1.1-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 ansible-lint +2 25.12.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 ansible-runner +1 2.4.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 ansible-sign 0.1.4-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 bindep 2.13.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 python3.11-distlib 0.4.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 python3.11-ruamel-yaml-clib 0.2.15-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 python3.11-subprocess-tee 0.4.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 python3.11-typing-extensions 4.15.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Inside 2 receptor +1 1.6.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 ansible-builder 3.1.1-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 ansible-dev-environment 25.12.2-1.1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 ansible-runner +1 2.4.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 ansible-sign 0.1.4-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 automation-controller +1 4.6.23-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 bindep 2.13.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 molecule +7 25.12.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-distlib 0.4.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-django 4.2.26-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-execnet 2.1.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-gunicorn 23.0.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-pluggy 1.6.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-pytest 9.0.1-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-pytest-xdist 3.8.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-ruamel-yaml-clib 0.2.15-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-subprocess-tee 0.4.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-tox-ansible 25.12.0-1.2.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 python3.11-typing-extensions 4.15.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform Developer 2 receptor +1 1.6.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 ansible-automation-platform-installer 2.5-20.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 ansible-builder 3.1.1-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 ansible-dev-environment 25.12.2-1.1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 ansible-runner +1 2.4.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 ansible-sign 0.1.4-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 automation-controller +4 4.6.23-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 automation-controller-fapolicyd 1.0-5.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 automation-eda-controller +4 1.1.14-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 automation-gateway +13 2.5.20251210-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 automation-hub +1 4.10.10-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 bindep 2.13.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 molecule +7 25.12.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-distlib 0.4.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-django 4.2.26-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-execnet 2.1.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-galaxy-importer 0.4.36-2.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-gunicorn 23.0.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-pluggy 1.6.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-pytest 9.0.1-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-pytest-xdist 3.8.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-ruamel-yaml-clib 0.2.15-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-subprocess-tee 0.4.2-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-tox-ansible 25.12.0-1.2.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 python3.11-typing-extensions 4.15.0-1.el8ap RHSA-2025:23069
Red Hat Ansible Automation Platform 2 receptor +1 1.6.2-1.el8ap RHSA-2025:23069

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling grafana-image-renderer 4.0.15-r1 —
Wolfi rolling jitsucom-jitsu +2 2.11.0-r2 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kubeflow-centraldashboard 1.10.0-r5 —
Wolfi rolling kubeflow-pipelines +11 2.14.3-r1 —
Wolfi rolling lerna 8.2.4-r2 —
Wolfi rolling opensearch-dashboards-3 3.4.0-r0 —
Wolfi rolling prism 5.14.2-r8 —
Wolfi rolling saf 1.5.1-r0 —
Wolfi rolling tileserver-gl +1 5.4.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm axios >= 1.0.0, < 1.12.0 1.12.0 GHSA-4hjh-wcwx-xvwj
npm axios >= 0.28.0, < 0.30.2 0.30.2 GHSA-4hjh-wcwx-xvwj

Advisories 10

References