PT-2026-35046 · Npm · Axios

Asadeddin · Published 2026-04-24 · Updated 2026-05-18 · CVE-2026-42036

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.15.1 Axios versions prior to 0.31.1

Description When the responseType variable is set to 'stream', the software returns the response stream without enforcing maxContentLength. This allows unbounded downstream consumption by bypassing configured response-size limits.

Recommendations Update to version 1.15.1 or newer. Update to version 0.31.1 or newer.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42036

GHSA-VF2M-468P-8V99

Affected Products

Axios

References · 211

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41238 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40175 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42338 · Security Note