CVE-2026-42036

What it actually does

Axios versions prior to 1.15.1 and 0.31.1 do not enforce the configured maxContentLength limit when responseType: 'stream' is used. If an application uses Axios to fetch attacker-controlled or untrusted URLs as streams, a remote server can return an extremely large or never-ending response and cause the consuming application to continue reading, buffering, piping, or processing data beyond intended limits. The direct impact is resource exhaustion, primarily memory, disk, CPU, connection pool, or downstream pipeline saturation, resulting in denial of service or degraded availability.

Why it matters to the business

Applications that use vulnerable Axios streaming requests against untrusted or attacker-influenced endpoints may experience slowdowns, crashes, worker exhaustion, excessive bandwidth usage, or failed background jobs. The risk is most relevant for services that proxy downloads, ingest remote files, process webhooks, fetch user-supplied URLs, or stream third-party content. The CVSS score is moderate, EPSS is currently low, it is not listed in CISA KEV, and no mature public exploit is indicated, but Axios is widely used across JavaScript and Node.js ecosystems, so affected dependency paths may be common and should be remediated during normal vulnerability management cycles.

How an attack unfolds

An attacker identifies functionality where the application uses Axios with responseType: 'stream' to retrieve content from a URL or service the attacker controls or can influence. The attacker causes the application to make a streaming request, for example by submitting a URL, triggering a webhook workflow, or interacting with a feature that fetches remote content. The malicious server responds with a very large payload, an indefinite chunked transfer, or a slow but continuous stream. Because vulnerable Axios versions do not apply maxContentLength to streamed responses, the stream is handed to application code without the expected size enforcement. If the application pipes or consumes the stream without independent limits, resources are exhausted and the affected process, queue worker, API route, or service instance may become unavailable.

How to fix it

Upgrade Axios to a fixed version: 1.15.1 or later for the 1.x line, or 0.31.1 or later for the 0.x line. If immediate upgrade is not possible, add explicit application-level stream controls: enforce byte counters on streamed responses, abort requests after a maximum number of bytes, configure request timeouts, limit redirects, reject untrusted URL schemes and internal addresses, restrict user-supplied URLs, limit concurrency, and apply backpressure-aware stream handling. Do not rely on maxContentLength alone for streamed responses in vulnerable versions. Where Axios is pulled in transitively, update lockfiles and dependent packages so the resolved Axios version is fixed.

How to confirm the fix worked

Confirm the resolved Axios version in package manifests and lockfiles is 1.15.1 or later, or 0.31.1 or later where the 0.x branch is used. Use package manager commands such as npm ls axios, yarn why axios, pnpm why axios, or software composition analysis tooling to identify direct and transitive vulnerable versions. Review code for Axios calls using responseType: 'stream' and verify they enforce independent maximum byte limits and abort behavior. In a controlled test environment, request a deliberately oversized or endless streaming response and confirm the application terminates the stream, returns an error, and remains stable without excessive memory, disk, CPU, or worker consumption.

Typical attack path

1. Find an application feature that fetches remote content using Axios streaming responses.
2. Provide or influence a URL that points to an attacker-controlled server or oversized resource.
3. Trigger the server-side Axios request with responseType: 'stream'.
4. Return an oversized, chunked, compressed, or never-ending HTTP response.
5. Rely on the vulnerable Axios behavior to bypass maxContentLength enforcement for the stream.
6. Cause the application or downstream processing pipeline to consume excessive memory, disk, CPU, bandwidth, file descriptors, or worker time.
7. Repeat requests or run them concurrently to amplify denial-of-service impact.

How to detect it

Investigate whether applications using vulnerable Axios versions made streaming HTTP requests to untrusted or unusual remote hosts followed by resource exhaustion symptoms. Relevant log sources include application request logs, worker/job logs, outbound proxy logs, egress firewall logs, DNS logs, container or host telemetry, process supervisor logs, and APM metrics. Look for long-lived outbound HTTP connections, responses with very large byte counts, chunked responses without normal completion, repeated aborted or timed-out stream-processing jobs, sudden increases in memory or disk usage, Node.js out-of-memory crashes, event-loop stalls, queue backlogs, and service restarts. Correlate user actions or inbound requests that trigger remote fetching with subsequent outbound requests and process instability. There are no universal attacker-specific indicators for this vulnerability; detection should focus on behavioral evidence of oversized or endless streamed responses and denial-of-service effects.

• responseType: 'stream'
• responseType:"stream"
• maxContentLength
• JavaScript heap out of memory
• FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
• FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
• ERR_STREAM_PREMATURE_CLOSE
• ECONNRESET
• ETIMEDOUT
• socket hang up
• Transfer-Encoding: chunked
• npm ls axios
• axios@1.15.0
• axios@1.14.
• axios@1.13.
• axios@1.12.
• axios@1.11.
• axios@1.10.
• axios@1.9.
• axios@1.8.
• axios@1.7.
• axios@1.6.
• axios@1.5.
• axios@1.4.
• axios@1.3.
• axios@1.2.
• axios@1.1.
• axios@1.0.
• axios@0.31.0
• axios@0.30.
• axios@0.29.
• axios@0.28.
• axios@0.27.
• axios@0.26.
• axios@0.25.
• axios@0.24.
• axios@0.23.
• axios@0.22.
• axios@0.21.

What your security team should do

• Inventory all JavaScript and Node.js applications that include Axios, including transitive dependencies and container images.
• Prioritize remediation for internet-facing services, URL fetchers, webhook processors, file ingestion systems, download proxies, crawlers, and any workload that streams untrusted remote content.
• Upgrade Axios to 1.15.1 or later, or 0.31.1 or later, and regenerate lockfiles to ensure the fixed version is actually deployed.
• Add application-level byte limits, timeouts, concurrency controls, and abort handling for all streamed HTTP responses, even after upgrading.
• Add tests that simulate oversized and never-ending streamed responses to prevent regressions.
• Monitor for unusual outbound bandwidth, long-lived HTTP client connections, memory growth, worker crashes, and queue backlogs associated with remote content fetching workflows.
• Because this is not currently KEV-listed and EPSS is low, treat it as important hygiene unless the application fetches attacker-controlled streams, in which case prioritize as an availability risk.