AIKIDO-2026-10820
axios is vulnerable to Uncontrolled Resource Consumption
53
Medium Risk
This Affects:
axiosTL;DR
The fetch-backed request path resolves the same size guard options as the HTTP adapter but previously skipped enforcing them, so responses and bodies could grow without the limits callers configured. The implementation now rejects oversized declared lengths, oversized outbound bodies when length is known, and large data URLs before decoding materializes them. That restores the intended backpressure boundary for deployments that chose the fetch adapter for network I/O.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
axios is vulnerable to Uncontrolled Resource Consumption in versions 1.0.0 - 1.15.2.
How to fix this
Upgrade the axios library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant