Executive brief
Axios is a popular HTTP client library used in Node.js applications. When configured to stream responses, Axios fails to enforce the maxContentLength limit, allowing applications to receive and process unbounded amounts of data despite having set a size boundary. This can lead to denial-of-service attacks through memory exhaustion or resource consumption.
Technical details
The vulnerability is a resource-exhaustion flaw (CWE-770) in Axios's HTTP adapter. When responseType is set to 'stream', the adapter immediately returns the response stream without validating it against the configured maxContentLength parameter. The maxContentLength enforcement code exists only in the non-streaming response buffering path (lib/adapters/http.js lines 797-810), so streamed responses bypass this check entirely. An attacker can exploit this by sending a response larger than the configured limit; the application will accept and process the full stream regardless of the boundary. The vulnerability requires network reachability and affects Node.js applications that rely on maxContentLength as a safety control while using streamed Axios requests. Patches are available in versions 1.15.1 and 0.31.1.
Affected products
- axios axios <=1.15.0, <=0.31.0
Timeline
- 2026-04-24: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched: Patched versions: 1.15.1 and 0.31.1