CVE-2026-42036

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42036) has been identified in Axios's handling of streamed HTTP responses. Axios supports maxContentLength to limit response sizes. However, when responseType: 'stream' is used with the Node.js HTTP adapter, this limit is not enforced. Applications consuming the returned stream can therefore process oversized responses, potentially causing resource exhaustion and denial of service.

This failure to enforce response-size limits maps to CWE-770 (Allocation of Resources Without Limits or Throttling), where an application consumes resources without adequate restrictions. In Axios, streamed responses bypass the configured maxContentLength limit. If downstream processing lacks independent limits, excessive response data could exhaust resources and impair application availability.

Details

Module Info

Product: Axios
Affected packages: axios
Affected versions:

• >=1.0.0, <1.15.1
• <0.31.1

GitHub repository: https://github.com/axios/axios
Published packages: https://www.npmjs.com/package/axios
Package manager: npm

• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects Node.js applications using Axios's HTTP adapter with responseType: 'stream' and relying on maxContentLength to restrict response sizes. Axios enforces this limit for buffered responses but returns streamed responses without enforcing it. The Axios advisory assigns a CVSS v3.1 score of 5.3.

An attacker-controlled server could supply an oversized response that the application continues consuming beyond its configured limit. Exploitation depends on the application consuming the stream without independently enforcing a size limit, potentially resulting in denial of service.

This behavior aligns with CWE-770 (Allocation of Resources Without Limits or Throttling). This category covers missing resource restrictions that can allow excessive consumption to degrade or interrupt service. Depending on how an application processes incoming data, the resources affected could include memory, CPU time, or storage.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.