CVE-2025-58754: Axios DoS Vulnerability Due to Lack of Data Size Check
Summary
CVE-2025-58754: Axios is vulnerable to DoS attack through lack of data size check. Affects axios versions < 1.12.0. Fixed in 1.12.0. How to fix ↓
Also tracked for
- node-axios · Debian:11
The same CVE-2025-58754 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular promise-based HTTP client for JavaScript, designed to make it easier to send asynchronous HTTP requests to REST endpoints and perform CRUD operations. It supports the Promise API that is native to JS ES6 and is widely used in both browser and Node.js environments. However, a critical vulnerability has been identified in Axios that allows attackers to exploit the data: URI scheme, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises when Axios processes a request with a data: URI. Instead of performing an HTTP request, it decodes the entire payload into memory without any size checks. This behavior allows an attacker to supply a very large data: URI, causing the Node.js process to allocate unbounded memory, which can lead to a crash. The affected code does not honor the maxContentLength or maxBodyLength configurations, which are intended to limit the size of HTTP responses. As a result, this vulnerability can be exploited to create a denial of service condition by overwhelming the memory resources of the application.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.0
This is the first release that contains the fix.
npm install axios@1.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can enforce size limits by inspecting the length of the Base64 payload before decoding it. If the payload exceeds a certain limit, reject the request. Here is an example of how to implement this check:
const base64SizeLimit = 100 * 1024; // 100 KB limit
if (url.startsWith('data:')) {
const base64Payload = url.split(',')[1];
if (base64Payload.length > base64SizeLimit) {
throw new Error('Payload exceeds size limit.');
}
}
Conclusion
In summary, the CVE-2025-58754 vulnerability in Axios allows for denial of service attacks due to improper handling of data: URIs. It is crucial to update to the patched version 1.12.0 or later to mitigate this risk. Additionally, implementing size checks as a workaround can provide temporary protection until the update is applied.
See every vulnerability recorded for axios →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check your application against this vulnerability using the Vulert playground without any signup.
If you do not update Axios, your application remains vulnerable to potential denial of service attacks, which could lead to crashes and downtime.
Yes, an attacker can exploit this vulnerability remotely by sending a specially crafted request containing a large data: URI.
Yes, this vulnerability specifically affects the Node.js environment where Axios is used, as it pertains to how the Node adapter handles data: URIs.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
