7.5
CVE-2025-58754
- EPSS 1.1%
- Veröffentlicht 12.09.2025 01:16:40
- Zuletzt bearbeitet 16.01.2026 15:15:52
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginAxios is vulnerable to DoS attack through lack of data size check
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.1% | 0.613 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
https://github.com/axios/axios/pull/7011
https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
https://github.com/axios/axios/releases/tag/v1.12.0
https://github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67
https://github.com/axios/axios/pull/7034
https://github.com/axios/axios/releases/tag/v0.30.2
https://github.com/axios/axios/commit/c30252f685e8f4326722de84923fcbc8cf557f06