Homepage

Allocation of Resources Without Limits or Throttling The advisory has been revoked - it doesn't affect any version of package grafana-prometheus  (opens in a new tab)

Threat Intelligence

EPSS
1.1% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-GRAFANAPROMETHEUS-12667558
  • published13 Sept 2025
  • disclosed12 Sept 2025
Report a new vulnerability Found a mistake?

Introduced: 12 Sep 2025

CVE-2025-58754  (opens in a new tab)
CWE-770  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana-prometheus package and not the grafana-prometheus package as distributed by Centos.

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'. Versions 0.30.2 and 1.12.0 contain a patch for the issue.