Packages / axios / Security

HighVulnerabilityGHSA-42xw-2xvc-qx8mCVE-2019-10742Published 29 May 2019

Denial of Service in axios

Affected releases · axios

  • 0.18.x0.18.0Fixed in 0.18.1
  • 0.17.x and older0.1.0 – 0.17.1No fix, no longer updated

On 0.18.x, the newest line:

npm install axios@0.18.1
1.x

  1. Not affected

    1.0.0 – 1.20.0

    71 releases, latest

0.x

  1. Affected

    0.1.0 – 0.18.0

    37 releases

  2. Fixed

    0.18.1 – 0.34.0

    32 releases

140 stable releases of axios, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

What happens

Versions of axios prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the maxContentLength property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service.

Recommendation

Upgrade to 0.18.1 or later.