Packages / axios / Security

ModerateVulnerabilityGHSA-vf2m-468p-8v99CVE-2026-42036Published 5 May 2026

Axios: HTTP adapter streamed responses bypass maxContentLength

Affected releases · axios

  • 1.x1.0.0 – 1.15.0Fixed in 1.15.1
  • 0.31.x0.31.0Fixed in 0.31.1
  • 0.30.x0.30.0 – 0.30.4No fix on this line yet
  • 0.29.x and older0.1.0 – 0.29.0No fix, no longer updated

On 1.x, the newest line:

npm install axios@1.15.1
1.x

  1. Affected

    1.0.0 – 1.15.0

    62 releases

  2. Fixed

    1.15.1 – 1.20.0

    9 releases, latest

0.x

  1. Affected

    0.1.0 – 0.31.0

    65 releases

  2. Fixed

    0.31.1 – 0.34.0

    4 releases

140 stable releases of axios, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for axios. It is read in your browser and sent nowhere.

What happens

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

  • 786-789: for responseType === 'stream', Axios immediately settles with the stream.

  • 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

  • Axios main at commit f7a4ee2

  • Node v24.2.0

Steps:

  1. Start an HTTP server that returns a 2 MiB response body.

  2. Call Axios with:

    • adapter: 'http'

    • responseType: 'stream'

    • maxContentLength: 1024

  3. Read the returned stream fully.

Observed:

  • Success; full 2097152 bytes readable.

Control check:

  • Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing. Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.