{"id":"CVE-2026-44488","aliases":["GHSA-777c-7fjr-54vf"],"url":"https://o3.security/vulnerability/CVE-2026-44488","summary":"Axios: Allocation of Resources Without Limits or Throttling in axios","details":"## Summary\n\nAxios versions `1.7.0` through `1.15.x` did not enforce configured request and response size limits when requests were sent with the `fetch` adapter. Applications that selected `adapter: 'fetch'`, or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than `maxContentLength` or `maxBodyLength` despite those limits being explicitly configured.\n\nThis can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large `data:` URL, or when an application forwards attacker-controlled request bodies through axios while relying on `maxBodyLength` as a boundary.\n\n## Impact\n\nThe impact is availability-only. Affected applications may process, buffer, or transmit data beyond the configured limit, potentially exhausting memory, CPU, or network resources.\n\nThis does not affect axios’s default unlimited behaviour by itself: `maxContentLength` and `maxBodyLength` default to `-1`. The vulnerability exists when an application has configured finite limits and expects axios to enforce them.\n\nServer-side runtimes are the primary concern. Browser impact is generally constrained by the browser process and browser fetch behavior, and should not be described as server process exhaustion.\n\n## Affected Functionality\n\nAffected functionality includes requests using the built-in `fetch` adapter with finite `maxContentLength` or `maxBodyLength` values.\n\nRelevant configurations include:\n\n- `adapter: 'fetch'`\n- `adapter: ['fetch', ...]` when `fetch` is selected\n- environments where neither `xhr` nor `http` is available and axios falls back to `fetch`\n- custom fetch environments configured through `env.fetch`\n\nUnaffected functionality includes:\n\n- Node.js default `http` adapter enforcement\n- versions before the fetch adapter was introduced\n- configurations that do not rely on finite axios size limits\n\n## Technical Details\n\nIn vulnerable versions, `lib/adapters/fetch.js` destructured request config without `maxContentLength` or `maxBodyLength`. The adapter dispatched `fetch()` and then materialized the response through `text()`, `arrayBuffer()`, `blob()`, or related resolvers without checking the configured response limit.\n\nThe fix in `e5540dc` added:\n\n- `maxContentLength` and `maxBodyLength` reads in `lib/adapters/fetch.js`\n- upfront `data:` URL decoded-size checks\n- outbound body-size checks before dispatch\n- `Content-Length` response pre-checks\n- streaming response enforcement\n- fallback checks for environments without `ReadableStream`\n- regression tests in `tests/unit/adapters/fetch.test.js`\n\n## Proof of Concept of Attack\n\n```js\nimport http from 'node:http';\nimport axios from 'axios';\n\nconst server = http.createServer((req, res) => {\n  let received = 0;\n\n  req.on('data', chunk => {\n    received += chunk.length;\n  });\n\n  req.on('end', () => {\n    res.end(JSON.stringify({ received }));\n  });\n});\n\nawait new Promise(resolve => server.listen(0, resolve));\nconst url = `http://127.0.0.1:${server.address().port}/`;\n\nawait axios.post(url, 'A'.repeat(2 * 1024 * 1024), {\n  adapter: 'fetch',\n  maxBodyLength: 1024\n});\n\n// Vulnerable versions succeed and the server receives 2097152 bytes.\n// Fixed versions reject with ERR_BAD_REQUEST.\n\nserver.close();\n```\n\n## Workarounds\n\nUse the Node.js `http` adapter for server-side requests where finite size limits are security-relevant.\n\nValidate or cap attacker-controlled request bodies before passing them to axios.\n\nReject or strictly allowlist attacker-controlled URL schemes, especially `data:` URLs, before calling axios.\n\n<details>\n<summary>Original Report</summary>\n\n### Summary\nWhen Axios is used with adapter: 'fetch', configured body/response size limits are not enforced. This allows oversized uploads/downloads (including data: URLs) despite explicit limits, which can lead to memory/resource exhaustion in server-side usage.\n\n### Details\nmaxBodyLength and maxContentLength are not applied in the fetch adapter flow:\n  - lib/adapters/fetch.js (146-160): config destructuring does not include these controls.\n  - lib/adapters/fetch.js (220-234): request is dispatched with fetch() without request-size enforcement.\n  - lib/adapters/fetch.js (267-283): response is materialized via text(), arrayBuffer(), blob(), etc. without response-size checks.\nBy contrast, the HTTP adapter enforces both limits.\n\n### PoC\n  Environment:\n  - Axios main at commit f7a4ee2\n  - Node v24.2.0\n\nSteps:\n  1. Start an HTTP server that counts received bytes and echoes {received}.\n  2. Send 2 MiB with:\n      - adapter: 'fetch'\n      - maxBodyLength: 1024\n  3. Request a 4 KiB data: URL with:\n      - adapter: 'fetch'\n      - maxContentLength: 16\n\nExpected secure behavior: both requests rejected.\n Observed:\n  - Upload: success, server received 2097152\n  - data: response: success, length 4096\n\n### Impact\nType: DoS / resource exhaustion due to limit bypass.\nImpacted: applications using Axios fetch adapter as a server-side security control boundary for untrusted request/response sizes.\n</details>\n\n---","published":"2026-06-11T15:37:38.013Z","modified":"2026-09-13T03:30:12.880443879Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00669,"percentile":0.49212,"asOf":"2026-08-25"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"axios","fixedVersion":"1.16.0"}],"fix":{"url":"https://github.com/axios/axios/pull/10795","label":"axios/axios#10795"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44488.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20889"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20938"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27044"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28964"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29082"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30650"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33155"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33160"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33163"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33173"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33183"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34160"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34374"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34525"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34527"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34530"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36883"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40262"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40768"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40792"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41031"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41055"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41064"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42085"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42142"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42146"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43052"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46885"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46903"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50300"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54188"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54555"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57191"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-44488"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44488.json"},{"type":"ADVISORY","url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487949"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10795"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10796"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.16.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-13T03:30:12.880443879Z"}}