CVE-2026-44488 Details

A vulnerability exists in Axios versions 1.7.0 through 1.15.x, allowing applications to bypass configured request and response size limits when using the fetch adapter. This issue can lead to resource exhaustion, particularly in server-side environments, where oversized responses from a malicious server or large attacker-controlled request bodies can overwhelm application resources. The vulnerability arises because the fetch adapter does not properly enforce size limits, allowing applications to send or receive data beyond the configured maximums. This issue is fixed in Axios versions 1.16.0 and 0.32.0.

For server-side requests where size limits are security-relevant, use the Node.js http adapter instead of the fetch adapter. Additionally, validate or cap attacker-controlled request bodies before sending them with Axios, and be cautious with data URLs by rejecting or allowlisting them before making Axios calls.