PT-2026-35046 · Npm · Axios

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-42036

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.15.1 Axios versions prior to 0.31.1

Description When the responseType variable is set to 'stream', the software returns the response stream without enforcing maxContentLength. This allows unbounded downstream consumption by bypassing configured response-size limits.

Recommendations Update to version 1.15.1 or newer. Update to version 0.31.1 or newer.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-42036

Affected Products

Axios

References · 3

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://twitter.com/CVEnew/status/2047798586948391163 · Twitter Post