CVE-2019-10742: Denial of Service in axios
Summary
CVE-2019-10742: Denial of Service in axios. Affects axios versions < 0.18.1. Fixed in 0.18.1. How to fix ↓
Also tracked for
- node-axios · Debian:11
The same CVE-2019-10742 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
axios is an npm package that is commonly used for making HTTP requests from Node.js or browser-based applications. It provides an easy-to-use API for sending HTTP requests and handling responses. However, versions of axios prior to 0.18.1 are vulnerable to a Denial of Service (DoS) attack. This vulnerability occurs when a request exceeds the maxContentLength property, causing high CPU usage and potentially leading to a DoS condition.
Vulnerability Detail
The vulnerability in axios arises from its failure to stop a request when it exceeds the maxContentLength property. Instead of terminating the request, the package prints an error message but continues processing the request. This can result in high CPU usage and potentially lead to a DoS attack. An attacker could exploit this vulnerability by sending a specially crafted request that exceeds the maxContentLength limit, causing the server to consume excessive resources and become unresponsive.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.1
This is the first release that contains the fix.
npm install axios@0.18.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the axios package.
Conclusion
In conclusion, the axios package prior to version 0.18.1 is vulnerable to a Denial of Service (DoS) attack. By exceeding the maxContentLength property, an attacker can cause high CPU usage and potentially render the server unresponsive. To mitigate this vulnerability, it is crucial to upgrade to version 0.18.1 or later of the axios package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for axios →
FAQ
This vulnerability can lead to a Denial of Service (DoS) condition, causing the affected server to become unresponsive and potentially disrupting the availability of the application or service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to promptly update the axios package to the fixed version to mitigate the risk of potential attacks.
As there is no specific workaround mentioned, the best course of action is to upgrade to the fixed version of the axios package. This ensures that the vulnerability is properly addressed and eliminates the risk of a DoS attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
