CVE-2026-42036: Axios HTTP Adapter Streamed Responses Bypass Max Content Length
Summary
CVE-2026-42036: Axios: HTTP adapter streamed responses bypass maxContentLength. Affects axios across 2 version ranges.
< 0.31.1
>= 1.0.0, < 1.15.1
Fixed in 0.31.1 or 1.15.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests in both Node.js and browser environments. It provides a simple API for handling requests and responses, supports promises, and allows for configuration of request and response properties. However, a vulnerability has been identified that affects its handling of streamed responses, potentially leading to unbounded consumption of resources.
Vulnerability Detail
The vulnerability arises when Axios is configured to use responseType: 'stream'. In this case, the library does not enforce the maxContentLength limit, allowing applications to read responses larger than intended. This can lead to Denial of Service (DoS) conditions, as applications may consume excessive memory or processing resources when handling large streamed responses. The issue originates from the way Axios processes streams in its HTTP adapter, where the maxContentLength check is bypassed for streamed responses.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.31.10.31.1npm install axios@0.31.1 -
>= 1.0.0, < 1.15.11.15.1npm install axios@1.15.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using responseType: 'stream' if you need to enforce maxContentLength. Instead, use responseType: 'arraybuffer' or 'text' to ensure that the maxContentLength limit is respected.
Conclusion
The Axios vulnerability CVE-2026-42036 allows for unbounded response processing when using streamed responses, which can lead to resource exhaustion. It is crucial to update to the latest version of Axios to mitigate this risk. Additionally, users can implement workarounds to avoid using streamed responses until they can upgrade.
See every vulnerability recorded for axios →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Versions of Axios prior to 1.15.1 and 0.31.1 are affected by this vulnerability.
The potential impacts include Denial of Service (DoS) due to unbounded resource consumption when handling large streamed responses.
Yes, you can avoid using responseType: 'stream' and instead use responseType: 'arraybuffer' or 'text' to enforce maxContentLength.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
