Denial of Service Vulnerability in Axios Package: CVE-2019-10742
Summary
CVE-2019-10742: Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded. Affects node-axios across 2 version ranges.
< 0.17.1+dfsg-2
< d59c70fdfd35106130e9f783d0dbdcddd145b58f
Fixed in 0.17.1+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular promise-based HTTP client for JavaScript, widely used in both Node.js and browser environments. It allows developers to make HTTP requests to external resources, providing a simple and intuitive API. The package is known for its ease of use, support for interceptors, and ability to handle requests and responses in a streamlined manner. However, certain versions of Axios are vulnerable to a denial of service attack, which can lead to application crashes under specific conditions.
Vulnerability Detail
CVE-2019-10742 is a vulnerability found in Axios versions up to and including 0.18.0. This issue arises when the application continues to accept content even after the maximum content length is exceeded, potentially leading to a denial of service. Attackers can exploit this flaw to cause the application to crash, disrupting service and affecting user experience. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0.17.1+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-axiosTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to restrict the size of incoming content. This can help mitigate the risk of denial of service by preventing excessively large payloads from being processed. Additionally, you can set a maximum content length in your Axios configuration as follows: axios.defaults.maxContentLength = 1000000; // Set to 1MB.
Conclusion
CVE-2019-10742 poses a significant risk to applications using affected versions of the Axios package, leading to potential denial of service attacks. It is crucial to upgrade to a secure version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for node-axios →
FAQ
CVE-2019-10742 is a vulnerability in the Axios package that allows attackers to cause a denial of service by exceeding the maximum content length.
Axios versions up to and including 0.18.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2019-10742 is 7.5, indicating a high severity level.
If you cannot upgrade immediately, implement input validation and set a maximum content length in your Axios configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for node-axios.
