AIKIDO-2026-60497

axios is vulnerable to Denial of Service (DoS)

Pre-CVE Published Sep 18, 2026

CVE Score

Medium

Denial of Service (DoS)

TL;DR

estimateDataURLDecodedBytes() undercounts the decoded byte size of a percent-embedded base64 data: URL, ignoring padding and percent-encoded content when checking a data: URL request against maxContentLength. A crafted data: URL can therefore carry a real decoded payload far larger than the configured limit while passing the pre-check, forcing axios to allocate and process an oversized buffer. The fix recomputes the estimate to include percent-encoded bytes and padding while excluding URL fragments, and the Node HTTP adapter now bounds the raw Buffer allocation to that corrected estimate.

How do I fix this?

Upgrade the axios library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you set maxContentLength while your application requests or otherwise processes data: URL responses that can contain percent-encoded content.