| Package | Affected versions | Patched versions |
|---|---|---|
| solspace/craft-freeform | < 4.1.30 | 4.1.30 |
Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).
Freeform version: 4.1.29 Craft CMS version: 4.16.8
When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.
https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj https://github.com/axios/axios/pull/7011 https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 https://github.com/axios/axios/releases/tag/v1.12.0
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free