How severe is GHSA-58q2-9x27-h2jm?

No CVSS score has been assigned to GHSA-58q2-9x27-h2jm yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-58q2-9x27-h2jm?

GHSA-58q2-9x27-h2jm affects the following packages: solspace/craft-freeform (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-58q2-9x27-h2jm?

Update solspace/craft-freeform to 4.1.30 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-58q2-9x27-h2jm is resolved across your whole dependency graph.

How do I detect GHSA-58q2-9x27-h2jm in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for solspace/craft-freeform, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-58q2-9x27-h2jm if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-58q2-9x27-h2jm?

O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-58q2-9x27-h2jm can be triaged on real exposure rather than presence alone.

Is GHSA-58q2-9x27-h2jm actively exploited in the wild?

No public exploit code has been indexed for GHSA-58q2-9x27-h2jm yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-58q2-9x27-h2jm published, and has it been updated?

GHSA-58q2-9x27-h2jm was published on January 15, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

Not in CISA KEV

GHSA-58q2-9x27-h2jm — solspace/craft-freeform

Fix: axios/axios#7011

GHSA-58q2-9x27-h2jm is a security vulnerability in solspace/craft-freeform. A fix is available for solspace/craft-freeform — see the affected versions and patch details below.

solspace/craft-freeform Has a DoS Vulnerability

Published

Jan 15, 2026

Updated

Feb 3, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Feb 3, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐘solspace/craft-freeform

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).

Freeform version: 4.1.29 Craft CMS version: 4.16.8

Impact

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj https://github.com/axios/axios/pull/7011 https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 https://github.com/axios/axios/releases/tag/v1.12.0

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`solspace/craft-freeform`	all versions	4.1.30`composer require solspace/craft-freeform:^4.1.30`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for solspace/craft-freeform, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update solspace/craft-freeform to 4.1.30 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-58q2-9x27-h2jm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-58q2-9x27-h2jm can be triaged on real exposure rather than presence alone.

Tailored to GHSA-58q2-9x27-h2jm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754). Freeform version: 4.1.29 Craft CMS version: 4.16.8 ### Impact When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very la

O3 Security · Impact-Aware SCA

Is GHSA-58q2-9x27-h2jm in your dependencies?

O3 Security finds GHSA-58q2-9x27-h2jm across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works