Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Node.js Axios Crashes with Large Data URLs

CVE-2025-58754 · published 1 year ago
Summary

Using large data URLs in Axios can cause the Node.js process to crash. This is a denial of service issue, but only affects older versions of Axios running on Node.js. Update to version 0.30.2 or 1.12.0 to fix the issue.

What to do
  • Update GitHub Actions axios to version 1.12.0.
  • Update GitHub Actions axios to version 0.30.2.
  • Update rootio @rootio/axios to version 1.7.9-root.io.6.
  • Update rootio @rootio/axios to version 1.11.0-root.io.7.
  • Update rootio @rootio/axios to version 1.11.0-root.io.8.
  • Update rootio @rootio/axios to version 1.8.4-root.io.7.
  • Update GitHub Actions axios to version 1.11.0-aikido.12.
  • Update rootio @rootio/axios to version 1.11.0-root.io.12.
  • Update GitHub Actions axios to version 1.8.4-aikido.8.
  • Update rootio @rootio/axios to version 1.8.4-root.io.8.
  • Update GitHub Actions axios to version 1.8.4-aikido.9.
  • Update rootio @rootio/axios to version 1.8.4-root.io.9.
  • Update GitHub Actions axios to version 1.12.0-aikido.10.
  • Update rootio @rootio/axios to version 1.12.0-root.io.10.
  • Update GitHub Actions axios to version 1.12.0-aikido.11.
  • Update rootio @rootio/axios to version 1.12.0-root.io.11.
  • Update rootio @rootio/axios to version 1.12.0-root.io.12.
  • Update GitHub Actions axios to version 1.8.4-aikido.7.
  • Update GitHub Actions axios to version 1.12.0-aikido.12.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions axios >= 1.0.0, < 1.12.0
>= 0.28.0, < 0.30.2
Fix: upgrade to 1.12.0
– axios axios < 0.30.2
>= 1.0.0, < 1.12.0
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
Root:npm rootio @rootio/axios < 1.7.9-root.io.6
< 1.11.0-root.io.7
< 1.11.0-root.io.8
< 1.8.4-root.io.7
< 1.11.0-root.io.12
< 1.8.4-root.io.8
< 1.8.4-root.io.9
< 1.12.0-root.io.10
< 1.12.0-root.io.11
< 1.12.0-root.io.12
Fix: upgrade to 1.7.9-root.io.6
Root:npm GitHub Actions axios < 1.11.0-aikido.12
< 1.8.4-aikido.8
< 1.8.4-aikido.9
< 1.12.0-aikido.10
< 1.12.0-aikido.11
< 1.8.4-aikido.7
< 1.12.0-aikido.12
Fix: upgrade to 1.11.0-aikido.12
Original advisory text
Axios is vulnerable to DoS attack through lack of data size check
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published12 Sep 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
ROOT-APP-NPM-CVE-2025-58754 · OSV
GHSA-4hjh-wcwx-xvwj · GHSA
CVE-2025-58754 · NVD
CVE-2025-58754 · OSV
Track software like this
Free during beta