En bref
- CVE-2026-42036 est une vulnérabilité MOYENNE (CVSS 5.3) touchant axios (axios), axios.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.33%, plus élevée que 25.8% des vulnérabilités.
- Correctif : mettre à jour vers 1.15.1, 0.31.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| axios | ≥ 1.0.0, < 1.15.1< 0.31.1
| 1.15.10.31.1
|
| axios npm | ≥ 1.0.0, < 1.15.1< 0.31.1
| 1.15.10.31.1
|
Description
Summary
When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
Details
In lib/adapters/http.js:
- 786-789: for responseType === 'stream', Axios immediately settles with the stream.
- 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.
So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.
PoC
Environment:
- Axios main at commit f7a4ee2
- Node v24.2.0
Steps:
- Start an HTTP server that returns a 2 MiB response body.
- Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
- Read the returned stream fully.
Observed:
- Success; full 2097152 bytes readable.
Control check:
- Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.
Impact
Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.
NVD description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free