MediumGHSA-vf2m-468p-8v99CVE-2026-42036

Axios: HTTP adapter streamed responses bypass maxContentLength

Published 5 May 2026 · Updated 10 Sept 2026

Affected packages

axiosnpm
Affected
>=1.0.0 <1.15.1
Fixed in
1.15.1
Update to the fixed version for your release line, for example:npm install axios@1.15.1
axiosnpm
Affected
<0.31.1
Fixed in
0.31.1
Update to the fixed version for your release line, for example:npm install axios@0.31.1

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

  • 786-789: for responseType === 'stream', Axios immediately settles with the stream.
  • 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

  • Axios main at commit f7a4ee2
  • Node v24.2.0

Steps:

1. Start an HTTP server that returns a 2 MiB response body. 2. Call Axios with:

  • adapter: 'http'
  • responseType: 'stream'
  • maxContentLength: 1024

3. Read the returned stream fully.

Observed:

  • Success; full 2097152 bytes readable.

Control check:

  • Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing. Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Is GHSA-vf2m-468p-8v99 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected axios, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.