Executive brief
axios is a widely-used HTTP client library for JavaScript that handles network requests in web and Node.js applications. Prior to version 0.18.1, the library fails to properly stop processing responses that exceed the configured maximum content length limit, causing the application to consume excessive CPU resources while continuing to download data. This can result in application slowdowns or crashes, affecting the availability of services that depend on axios.
Technical details
The vulnerability exists in the HTTP adapter component of axios (lib/adapters/http.js). When a response exceeds the configured maxContentLength, the library logs an error but fails to destroy the underlying stream, causing it to continue buffering and processing data. This results in expensive repeated buffer concatenation operations that consume CPU cycles until the entire response completes, even though it will ultimately be rejected. The attack vector is network-based with no authentication or user interaction required; an attacker can trigger the DoS by causing a vulnerable application to make HTTP requests to a remote server that sends a large response. The fix, implemented in version 0.18.1, adds a stream.destroy() call immediately upon detecting the size limit violation, allowing the request to terminate cleanly.
Affected products
- axios axios <0.18.1
Timeline
- 2019-05-29: disclosed: GHSA advisory published
- 2019-05-07: patched: Version 0.18.1 released with fix
- 2017-09-22: other: Vulnerability introduced