Read the docs
TI-2025-36412 Aliases CVE-2025-58754GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

Priority HIGH 72CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 20 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01196 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.12.0, 0.30.2axios (npm): 1.12.0, 0.30.2Red Hat: 21 advisoriesRed Hat: 20 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.0.0 to before 1.12.0; 0.28.0 to before 0.30.21.12.0, 0.30.2Patch availableCNA
—axios (npm)1.0.0 to before 1.12.01.12.0Patch availableGHSA-4hjh-wcwx-xvwj
—axios (npm)0.28.0 to before 0.30.20.30.2Patch availableGHSA-4hjh-wcwx-xvwj
  • axios Vendoraxios Affected 1.0.0 to before 1.12.0; 0.28.0 to before 0.30.2 Fixed in 1.12.0, 0.30.2 Patch available CNA
  • axios (npm) Vendor— Affected 1.0.0 to before 1.12.0 Fixed in 1.12.0 Patch available GHSA-4hjh-wcwx-xvwj
  • axios (npm) Vendor— Affected 0.28.0 to before 0.30.2 Fixed in 0.30.2 Patch available GHSA-4hjh-wcwx-xvwj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*before 0.30.2; 1.0.0 to before 1.12.0Vulnerableaxios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions before 0.30.2; 1.0.0 to before 1.12.0 Vulnerable ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.12.0, 0.30.2
  • Fix · GHSA-4hjh-wcwx-xvwj axios (npm) Fixed in 1.12.0 Advisory →
  • Fix · GHSA-4hjh-wcwx-xvwj axios (npm) Fixed in 0.30.2 Advisory →

Red Hat 21 advisories

  • RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
    New container image: rhceph-9.2
    • Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:6226 Released 2026-03-31 · Red Hat rating Important
    Multicluster Global Hub 1.6.2 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
Show 18 more Red Hat advisories
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1018 Released 2026-01-22 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.17.4 security update
    • Red Hat OpenShift GitOps 1.17 registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +4
  • RHSA-2026:0718 Released 2026-01-15 · Red Hat rating Important
    Moderate: Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +24
  • RHSA-2026:0627 Released 2026-01-14 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9 +19
  • RHSA-2025:23546 Released 2025-12-17 · Red Hat rating Important
    Red Hat Quay 3.16.0
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-container-security-operator-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2025:23131 Released 2025-12-11 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/eda-controller-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8 +2
  • RHSA-2025:23069 Released 2025-12-10 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-automation-platform-installer-2.5-20.el8ap, ansible-builder-3.1.1-1.el8ap, ansible-creator-25.12.0-1.el8ap +47
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-automation-platform-installer-2.5-20.el9ap, ansible-builder-3.1.1-1.el9ap, ansible-creator-25.12.0-1.el9ap +47
  • RHSA-2025:22759 Released 2025-12-04 · Red Hat rating Important
    RHOAI 2.22.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.22 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +8
  • RHSA-2025:22684 Released 2025-12-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +5
  • RHSA-2025:19961 Released 2025-11-10 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9 +6
  • RHSA-2025:19804 Released 2025-11-05 · Red Hat rating Moderate
    RHACS 4.7.8 security and bug fix update
    • Red Hat Advanced Cluster Security 4.7 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2025:19529 Released 2025-11-03 · Red Hat rating Important
    Red Hat Developer Hub 1.7.2 release.
    • Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2025:19375 Released 2025-10-30 · Red Hat rating Moderate
    RHACS 4.8.5 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2025:19335 Released 2025-10-30 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes 2.14.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +9
  • RHSA-2025:19221 Released 2025-10-28 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-rhel9
  • RHSA-2025:18252 Released 2025-10-16 · Red Hat rating Moderate
    Kiali 2.11.4 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2025:16747 Released 2025-09-25 · Red Hat rating Moderate
    Red Hat Developer Hub 1.6.5 release.
    • Red Hat Developer Hub 1.6 registry.redhat.io/rhdh/rhdh-hub-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
Network Observability OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Discovery 1AffectedNo fix yet
Red Hat Discovery 2AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Trusted Profile AnalyzerAffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
streams for Apache Kafka 2AffectedNo fix yet
Multicluster Global Hub 1.6.6Fixed RHSA-2026:6226
Red Hat Advanced Cluster Management for Kubernetes 2.12Fixed RHSA-2025:19961
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:0627
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2025:19335
Red Hat Advanced Cluster Security 4.7Fixed RHSA-2025:19804
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2025:19375
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2025:23131
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2025:23069
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2025:23069
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2025:19221
Red Hat Ceph Storage 9.2Fixed RHSA-2026:86618
Red Hat Developer Hub 1.6Fixed RHSA-2025:16747
Red Hat Developer Hub 1.7Fixed RHSA-2025:19529
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.22Fixed RHSA-2025:22759
Red Hat OpenShift GitOps 1.17Fixed RHSA-2026:1018
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2025:18252
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.16Fixed RHSA-2025:23546
Not affected: 36 products
  • Cryostat 4
  • Gatekeeper 3
  • Migration Toolkit for Applications 7
  • Migration Toolkit for Applications 8
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.6.6
  • OpenShift Serverless
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security 4.7
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ceph Storage 9.2
  • Red Hat Developer Hub 1
  • Red Hat Developer Hub 1.6
  • Red Hat Developer Hub 1.7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.22
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.17
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat build of Apache Camel - HawtIO 4
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58754
  2. 2026-10-03 Alias added: GHSA-4hjh-wcwx-xvwj
  3. 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
  4. 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Patch 3

Advisory 1

Other 5

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
  • TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
  • TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
  • TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences