CVE-2026-42036 Details
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
A vulnerability in Axios, a promise-based HTTP client for the browser and Node.js, allows for unbounded downstream consumption of response data when the responseType is set to 'stream'. This issue is present in versions of Axios prior to 1.15.1 and 0.31.1. The vulnerability arises because Axios does not enforce the maxContentLength parameter for streamed responses, bypassing configured response-size limits. As a result, Node.js applications that rely on maxContentLength as a safety boundary while using streamed Axios responses may be vulnerable to denial-of-service conditions through unbounded response processing.
Users can upgrade to Axios versions 1.15.1 or 0.31.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | < 0.31.1 >= 1.0.0, < 1.15.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |