IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axios

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Published: (5 months ago)

Description

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.

Weakness (CWE): CWE-770

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
acm 2.11 —
acm 2.13 —
acm 2.14 —
acm 2.15 —
acm 2.16 —
advanced cluster security 4.10 —
advanced cluster security 4.9 —
ansible automation platform 2.5 —
ansible automation platform 2.6 —
ansible automation platform 2.7 —
axios axios >= 1.7.0, < 1.16.0
discovery 2 —
migration toolkit applications 8.1 —
multicluster engine 2.10 —
multicluster engine 2.6 —
multicluster engine 2.8 —
multicluster engine 2.9 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
openshift 4.22 —
openshift ai 3.4 —
openshift devspaces 3.29 —
quay 3.10 —
quay 3.12 —
quay 3.15 —
quay 3.16 —
quay 3.9 —
Red Hat Cryostat 4 —
Red Hat Gatekeeper 3 —
Red Hat Migration Toolkit for Applications 8 —
Red Hat multicluster engine for Kubernetes 2.1 all versions
Red Hat multicluster engine for Kubernetes 2.6 all versions
Red Hat multicluster engine for Kubernetes 2.8 all versions
Red Hat multicluster engine for Kubernetes 2.9 all versions
Red Hat Network Observability Operator —
Red Hat OpenShift Pipelines all versions
Red Hat OpenShift Service Mesh 3 —
Red Hat Red Hat 3scale API Management Platform 2 —
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 all versions
Red Hat Red Hat Advanced Cluster Security 4.9 all versions
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 all versions
Red Hat Red Hat AMQ Broker 7.13.6 —
Red Hat Red Hat AMQ Broker 7.14.1 —
Red Hat Red Hat Ansible Automation Platform 2 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.7 all versions
Red Hat Red Hat Data Grid 8.6.2 —
Red Hat Red Hat Developer Hub 1.10 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Discovery 2 all versions
Red Hat Red Hat Migration Toolkit 1.8 all versions
Red Hat Red Hat Migration Toolkit for Applications 8.1 all versions
Red Hat Red Hat OpenShift AI 3.4 all versions
Red Hat Red Hat OpenShift Container Platform 4.13 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
Red Hat Red Hat OpenShift Container Platform 4.21 all versions
Red Hat Red Hat OpenShift Container Platform 4.22 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.29 all versions
Red Hat Red Hat OpenShift Service Mesh 2.6 all versions
Red Hat Red Hat OpenShift Service Mesh 3.0 all versions
Red Hat Red Hat OpenShift Service Mesh 3.1 all versions
Red Hat Red Hat OpenShift Service Mesh 3.2 all versions
Red Hat Red Hat OpenShift Service Mesh 3.3 all versions
Red Hat Red Hat Quay 3.10 all versions
Red Hat Red Hat Quay 3.12 all versions
Red Hat Red Hat Quay 3.15 all versions
Red Hat Red Hat Quay 3.16 all versions
Red Hat Red Hat Quay 3.9 all versions
Red Hat Red Hat Satellite 6.19 all versions
Red Hat Red Hat Trusted Artifact Signer 1.3 all versions
rhdh 1.10 —
rhdh 1.9 —
rhmt 1.8 —
satellite 6.19 —
service mesh 2.6 —
service mesh 3.0 —
service mesh 3.1 —
service mesh 3.2 —
service mesh 3.3 —
trusted artifact signer 1.3 —

References and patches

CPE matches (NVD) (1)
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* ≥ 1.7.0 < 1.16.0