Allocation of Resources Without Limits or Throttling Affecting axios package, versions >=1.13.0 <1.18.0

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on streamed uploads because the byte-counting wrapper is gated on config.maxBodyLength > -1 && config.maxRedirects === 0 and the HTTP/2 path bypasses follow-redirects with default redirect settings. An attacker who controls the upload stream can force the application to transmit arbitrarily large outbound payloads, exhausting egress, upstream quota, or connection and memory budgets, by feeding stream contents into an HTTP/2 request with a finite maxBodyLength that the limit check never inspects. Exploitation requires the Node HTTP adapter with httpVersion: 2, request data supplied as a stream, and a finite maxBodyLength, while HTTP/1.1 requests through follow-redirects, buffered String/Buffer/ArrayBuffer bodies, and the default unlimited maxBodyLength: -1 are unaffected.

This vulnerability can be avoided on axios 1.15.1 and later by setting maxRedirects: 0 on the affected HTTP/2 streamed upload calls, which activates the existing byte-counting wrapper so oversized streams are rejected.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release