Asadeddin

[Content removed]

**Name of the Vulnerable Software and Affected Versions** axios versions 1.13.0 and later **Description** When using the Node.js HTTP adapter, the software fails to enforce the `maxBodyLength` limit on streamed request bodies if the requests are sent with `httpVersion: 2`. This occurs because the Node.js HTTP/2 request API does not honor the `maxBodyLength` option, and the internal byte-counting stream wrapper is only activated when `maxRedirects` is set to 0. An attacker who controls a stream passed to the software can cause the application to transmit outbound data that exceeds the configured finite `maxBodyLength`. This can lead to resource consumption and policy bypass, such as excess outbound bandwidth, increased egress costs, upstream quota consumption, and limited availability of the application or upstream peer. This issue does not allow for code execution, credential disclosure, or request-destination control. **Recommendations** For versions 1.15.1 and later, set `maxRedirects: 0` on affected HTTP/2 streamed upload calls to activate the stream wrapper and reject oversized streams. For versions prior to 1.15.1, pre-limit the stream with a byte-counting transform before passing it to the software, reject oversized uploads before forwarding them, or avoid using `httpVersion: 2` for untrusted streamed uploads.

**Name of the Vulnerable Software and Affected Versions** axios versions prior to 0.33.0 axios versions 1.x prior to 1.18.0 **Description** Axios can consume inherited properties from nested request option objects when the JavaScript process's `Object.prototype` has been polluted by another component. While the top-level merged configuration uses a null prototype for protection, nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects and read without own-property checks. If an application passes placeholder nested objects (e.g., `auth: {}` or `paramsSerializer: {}`), inherited values can be silently injected into outbound requests. Technical details include: - Silent injection of an `Authorization: Basic` header via inherited `username` and `password` variables. - Alteration of query-string serialization via inherited `encode` and `serialize` variables. Full replacement of the query string requires a function-valued pollution primitive. This issue is exploitable only if prototype pollution already exists within the environment. Affected functionality includes Node HTTP adapter Basic auth handling in `lib/adapters/http.js`, Browser/fetch/XHR Basic auth handling through `lib/helpers/resolveConfig.js`, and query serialization through `lib/helpers/buildURL.js` and `axios.getUri()`. **Recommendations** Update axios to version 0.33.0 or later. Update axios to version 1.18.0 or later. As a temporary workaround, avoid passing placeholder nested option objects; remove the `auth` property entirely when Basic auth is not intended, and provide explicit own `encode` and `serialize` properties for `paramsSerializer` objects or remove the `paramsSerializer` when custom serialization is not required.

**Name of the Vulnerable Software and Affected Versions** Axios versions prior to 0.31.1 Axios versions prior to 1.15.1 **Description** For stream request bodies, the `maxBodyLength` limit is bypassed when `maxRedirects` is set to 0 using the native http/https transport path. This allows oversized streamed uploads to be sent in full, even when strict body limits are configured by the caller. **Recommendations** Update to version 0.31.1. Update to version 1.15.1.

**Name of the Vulnerable Software and Affected Versions** Axios versions prior to 1.15.1 Axios versions prior to 0.31.1 **Description** When the `responseType` variable is set to 'stream', the software returns the response stream without enforcing `maxContentLength`. This allows unbounded downstream consumption by bypassing configured response-size limits. **Recommendations** Update to version 1.15.1 or newer. Update to version 0.31.1 or newer.