- Description
- Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.
- Source
- security-advisories@github.com
- NVD status
- Modified
- Products
- axios
CVSS 3.1
- Type
- Secondary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-770
- Hype score
- Not currently trending
GHSA-58Q2-9X27-H2JM: The Infinite Buffer: Crashing Craft CMS via Axios Data URIs A deep dive into CVE-2025-58754, where the popular Axios library's mishandling of `data:` URIs allows unauthenticated attackers to trigger Out-of-Memory (OOM) crashes in ... https://t.co/c3SvJknx4B
@_cvereports
16 Jan 2026
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔵 solspace/craft-freeform, DoS, #CVE-2025-58754 (low) https://t.co/3ywMPw55QS
@dailycve
15 Jan 2026
12 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Today I ran into two critical vulnerabilities CVE-2025-27152 & CVE-2025-58754 To be safe, I run automation scripts every single day to check for zero day vulnerabilities & manually check all production servers before starting any process. As a developer and a pentester
@nyuiela
13 Dec 2025
43 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Axiosの脆弱性がNode.jsのプロセスをクラッシュさせる可能性(CVE-2025-58754) https://t.co/pRRkwWcF1A #セキュリティ対策Lab #セキュリティ #Security
@securityLab_jp
16 Sept 2025
106 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
A vulnerability in the Axios HTTP client (CVE-2025-58754) allows attackers to trigger denial-of-service in Node.js applications by exploiting unbounded memory allocation when decoding `data:` URIs. #vulnerability
@CyberDigests
14 Sept 2025
1 Impression
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
New Axios Vulnerability: CVE-2025-58754 Axios is affected by a memory exhaustion issue in Node.js Data URI handling. Apps can be DoSed if untrusted Data URIs are processed. For more details, read ZeroPath's blog on this vuln. #AppSec #NodeJS #InfoSec https://t.co/z8jK1zSYv7
@ZeroPathLabs
12 Sept 2025
14 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-58754 Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.11.0 runs on Node.js and is given a URL with the `data:` scheme, it do… https://t.co/0HkCCwjBO7
@CVEnew
12 Sept 2025
424 Impressions
2 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "42CE8592-2921-474D-9A2A-B0ABFEDB2304",
"versionEndExcluding": "0.30.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "037955F5-7C7D-4C3F-886B-52B009B97300",
"versionEndExcluding": "1.12.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]