CVE-2025-58754 Details

A denial-of-service vulnerability has been identified in Axios versions prior to 1.11.0 when used in Node.js. The issue arises when Axios is given a data URL, which is not handled as a standard HTTP request. Instead, the Node.js HTTP adapter decodes the entire payload into memory, creating a synthetic 200 response. This process ignores any specified maximum content or body length limits, allowing an attacker to send a large data URI that can exhaust memory resources and crash the application. This vulnerability is particularly problematic because it can occur even when the response type is set to 'stream', which is typically used to handle large data transfers without overloading memory.

Users can upgrade to Axios version 1.12.0 or later, where this vulnerability has been patched. The updated version enforces maximum content length limits on data URLs, preventing the decoding of excessively large payloads that could lead to memory exhaustion.