CVE-2026-42034

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42034) has been identified in Axios’s handling of streamed HTTP uploads. Axios supports maxBodyLength to limit outgoing request sizes. However, when maxRedirects: 0 is configured, streamed request bodies bypass this limit and can be transmitted in full. Oversized uploads may therefore consume excessive resources and potentially cause denial of service.

This failure to enforce upload-size limits maps to CWE-770 (Allocation of Resources Without Limits or Throttling), where intended restrictions on resource consumption are missing or ineffective. In Axios, streamed uploads can exceed the configured maxBodyLength when redirects are disabled. Without independent limits, processing these uploads could exhaust resources and impair service availability.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions:
  • >=1.0.0, <1.15.1
  • <0.31.1
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects Node.js applications using Axios’s HTTP adapter with streamed request bodies, maxRedirects: 0, and a configured maxBodyLength. Disabling redirects selects the native HTTP/HTTPS transport, which does not enforce Axios’s body-size setting. Axios pipes the stream into the request without counting bytes. The advisory assigns a CVSS v3.1 score of 5.3.

An attacker who can influence data forwarded through an affected upload stream could cause the application to transmit more data than intended. Exploitation depends on the vulnerable configuration and the absence of independent upload limits, potentially resulting in resource exhaustion or denial of service.

This behavior aligns with CWE-770 (Allocation of Resources Without Limits or Throttling). Ineffective resource limits can allow excessive work to consume capacity needed by other operations. The practical impact depends on how the sending application and receiving service process the oversized upload.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.