Allocation of Resources Without Limits or Throttling The advisory has been revoked - it doesn't affect any version of package node-axios (opens in a new tab)

Threat Intelligence

0.67% (50^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-DEBIAN12-NODEAXIOS-17328762
published13 Jun 2026
disclosed11 Jun 2026

Report a new vulnerability Found a mistake?

Introduced: 11 Jun 2026

CVE-2026-44488 (opens in a new tab) CWE-770 (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:12.

NVD Description

Note: Versions mentioned in the description apply only to the upstream node-axios package and not the node-axios package as distributed by Debian.

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.