PT-2026-35045 · Npm · Axios

Asadeddin · Published 2026-04-24 · Updated 2026-05-18 · CVE-2026-42034

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.31.1 Axios versions prior to 1.15.1

Description For stream request bodies, the maxBodyLength limit is bypassed when maxRedirects is set to 0 using the native http/https transport path. This allows oversized streamed uploads to be sent in full, even when strict body limits are configured by the caller.

Recommendations Update to version 0.31.1. Update to version 1.15.1.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42034

GHSA-5C9X-8GCM-MPGX

Affected Products

Axios

References · 211

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BE61221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41238 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33891 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-15599 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27903 · Security Note