PT-2025-37272 · Openjs Foundation+1 · Axios+1

Ameerassadi · Published 2025-09-11 · Updated 2026-05-08 · CVE-2025-58754

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.11.0

Description Axios, a promise-based HTTP client for browsers and Node.js, is susceptible to a denial-of-service (DoS) attack when running on Node.js and processing URLs with the data: scheme. The Node http adapter decodes the entire payload from the data: URI into memory without size limitations, ignoring maxContentLength and maxBodyLength configurations. This allows an attacker to supply a large data: URI, causing unbounded memory allocation and potentially crashing the process, even when responseType is set to 'stream'. Approximately 2.2 million instances are potentially vulnerable.

Recommendations Update to Axios version 1.11.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-58754

GHSA-4HJH-WCWX-XVWJ

RHSA-2025:23069

Affected Products

Axios

Debian

References · 31

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58754.json · Exploit
• https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 · Patch
• https://github.com/axios/axios/pull/7011 · Patch
• https://github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-58754 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-58754 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58754 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58754 · Security Note
• https://osv.dev/vulnerability/GHSA-4hjh-wcwx-xvwj · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-58754 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-58754 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-58754 · Vendor Advisory
• https://github.com/axios/axios · Note