要点
- CVE-2026-42036 は axios (axios), axios に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.33%（全脆弱性の 25.8% より高い）。
- 対処：1.15.1, 0.31.1 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| axios | ≥ 1.0.0, < 1.15.1< 0.31.1
| 1.15.10.31.1
|
| axios npm | ≥ 1.0.0, < 1.15.1< 0.31.1
| 1.15.10.31.1
|
概要
Summary
When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
Details
In lib/adapters/http.js:
- 786-789: for responseType === 'stream', Axios immediately settles with the stream.
- 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.
So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.
PoC
Environment:
- Axios main at commit f7a4ee2
- Node v24.2.0
Steps:
- Start an HTTP server that returns a 2 MiB response body.
- Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
- Read the returned stream fully.
Observed:
- Success; full 2097152 bytes readable.
Control check:
- Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.
Impact
Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.
NVD の説明
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン