solspace/craft-freeform Has a DoS Vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-770.
Summary
### Summary Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754). Freeform version: 4.1.29 Craft CMS version: 4.16.8 ### Impact When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj https://github.com/axios/axios/pull/7011 https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 https://github.com/axios/axios/releases/tag/v1.12.0
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | solspace/craft-freeform (Packagist) | before 4.1.30 | 4.1.30 | Patch available | GHSA-58q2-9x27-h2jm |
- solspace/craft-freeform (Packagist) Vendor— Affected before 4.1.30 Fixed in 4.1.30 Patch available GHSA-58q2-9x27-h2jm
Remediation
- Fix · GHSA-58q2-9x27-h2jm solspace/craft-freeform (Packagist) Fixed in 4.1.30 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-58q2-9x27-h2jm
References
Other 8
- https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
- https://github.com/solspace/craft-freeform/security/advisories/GHSA-58q2-9x27-h2jm
- https://github.com/axios/axios/pull/7011
- https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
- https://github.com/solspace/craft-freeform/commit/e7402a1d1ce9f28ecb6ce659885ac66391d3a040
- https://github.com/axios/axios/releases/tag/v1.12.0
- https://github.com/solspace/craft-freeform
- https://github.com/solspace/craft-freeform/releases/tag/v4.1.30
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences