Skip to content
Fencer Intel
high 7.5

CVE-2025-58754 json

Axios is vulnerable to DoS attack through lack of data size check

published last yr. modified 21d ago also EUVD-2025-28992 , GHSA-4hjh-wcwx-xvwj

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.

Patch / fix

  • npm axios 0.30.2, 1.12.0
  • axios axios 0.30.2, 1.12.0
  • node-axios Debian 14 1.12.1+dfsg-1

debian advisories DEBIAN-CVE-2025-58754

  • bindep ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 2.13.0-1.el8ap
  • bindep ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 2.13.0-1.el9ap
  • molecule ansible automation platform developer 2.5, ansible automation platform 2.5 25.12.0-1.el8ap
  • molecule ansible automation platform developer 2.5, ansible automation platform 2.5 25.12.0-1.el9ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.2-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.2-1.el9ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.2-1.el8ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.2-1.el9ap

red hat advisories RHSA-2025:23069

Is CVE-2025-58754 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-58754 updated cvss 5.3

axios: Axios DoS via lack of data size check

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-compat-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-hub-db-migration-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: workaround, no fix available
  • Red Hat Data Grid 8 org.infinispan-infinispan-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Discovery 1 discovery/discovery-ui-rhel9 Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Fuse 7 io.apicurio-apicurito
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/code-rhel9, devspaces/traefik-rhel9, devspaces/dashboard-rhel8, devspaces/dashboard-rhel9, devspaces/configbump-rhel9, +4 more Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 org.kie-process-migration-service Red Hat Trusted Artifact Signer rhtas/createtree-rhel9, rhtas/updatetree-rhel9, rhtas/trillian-redis-rhel9, rhtas/trillian-database-rhel9, rhtas/trillian-logserver-rhel9, rhtas/trillian-logsigner-rhel9
    affected: workaround, no fix available
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix planned “Will not fix”
show 21 more
  • Red Hat streams for Apache Kafka 2 com.github.streamshub-console
    affected: workaround, no fix available
  • Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub 1773650060
    fixed: vendor fix RHSA-2026:6226
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 rhacm2
    fixed: vendor fix RHSA-2025:19961
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1767570373
    fixed: vendor fix RHSA-2026:0627
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2
    fixed: vendor fix RHSA-2025:19335
  • Red Hat Advanced Cluster Security 4.7 advanced-cluster-security
    fixed: vendor fix RHSA-2025:19804
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security
    fixed: vendor fix RHSA-2025:19375
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25
    fixed: vendor fix RHSA-2025:23131
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 bindep 2.13.0-1.el8ap, molecule 25.12.0-1.el8ap, ansible-sign 0.1.4-1.el8ap, ansible-lint 25.12.0-1.el8ap, ansible-builder 3.1.1-1.el8ap, automation-hub 4.10.10-1.el8ap, +21 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 bindep 2.13.0-1.el9ap, molecule 25.12.0-1.el9ap, ansible-sign 0.1.4-1.el9ap, ansible-lint 25.12.0-1.el9ap, ansible-builder 3.1.1-1.el9ap, automation-hub 4.10.10-1.el9ap, +21 more
    fixed: vendor fix RHSA-2025:23069
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26
    fixed: vendor fix RHSA-2025:19221
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Developer Hub 1.6 rhdh 1.6.4-1758729326
    fixed: vendor fix RHSA-2025:16747
  • Red Hat Developer Hub 1.7 rhdh 1.7.2-1761774405
    fixed: vendor fix RHSA-2025:19529
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928
  • Red Hat OpenShift AI 2.22 rhoai v2.22.3-1764637896
    fixed: vendor fix RHSA-2025:22759
  • Red Hat OpenShift GitOps 1.17 openshift-gitops-1 1768824533
    fixed: vendor fix RHSA-2026:1018
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh 2.11.4-1759569680, openshift-service-mesh 2.11.4-1759998697
    fixed: vendor fix RHSA-2025:18252
  • Red Hat Quay 3.14 quay 1773097621
    fixed: vendor fix RHSA-2026:4215
  • Red Hat Quay 3.15 quay 1770146565
    fixed: vendor fix RHSA-2026:1942
  • Red Hat Quay 3.16 quay v3.16.0-1765994726
    fixed: vendor fix RHSA-2025:23546
  • Red Hat Cryostat 4 io.cryostat-cryostat Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9
    not affected: vulnerable code not present

33 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-071-03 updated cvss 7.5

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm axios
>=1.0.0, <1.12.0
>=0.28.0, <0.30.2
1.12.0
0.30.2

Affected products

  • axios axios

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.