Introduction
A single HTTP request can bring down a Node.js service if it uses Axios to process attacker-controlled data URIs. Axios is one of the most widely used HTTP client libraries in JavaScript, with over 292 million downloads a month. CVE-2025-58754 affects all Axios versions prior to 1.11.0 and allows memory exhaustion attacks that can crash the affected process.
Technical Information
CVE-2025-58754 is a memory allocation vulnerability in the Node.js HTTP adapter of Axios. When Axios receives a URL with the data: scheme, it does not make an HTTP request. It decodes the entire payload of the data URI into memory as a Buffer or Blob instead. This code path ignores the maxContentLength and maxBodyLength configuration options, which exist to protect applications from large HTTP responses.
If an attacker can supply a data URI with a very large payload, Axios allocates memory for the entire decoded content, whatever limits are configured. That can quickly exhaust available memory and crash the Node.js process. It happens even when the application asks for a streaming response with responseType: 'stream'.
The vulnerability is present in all Axios versions before 1.11.0. The fix, released in version 1.11.0, applies the same content length checks to data URI payloads as to HTTP responses, so memory allocation is no longer unbounded.
Affected Systems and Versions
- Product: Axios (npm package
axios) - Affected versions: All versions prior to 1.11.0
- Vulnerable configuration: Node.js environment, when Axios is used to process URLs with the
data:scheme
Vendor Security History
Axios is widely used in the JavaScript community, and its maintainers respond quickly. The project has fixed several notable vulnerabilities in recent years, including:
- CVE-2025-7783 (predictable boundary values in form-data)
- CVE-2025-27152 (SSRF and credential leakage)
The maintainers use GitHub advisories and have a mature disclosure and patching process.
