CVE-2026-44488

Name of the Vulnerable Software and Affected Versions Axios versions 1.7.0 through 1.15.x

Description Axios fails to enforce configured request and response size limits when using the fetch adapter. This occurs when applications explicitly set adapter: 'fetch', use a configuration where fetch is selected from a list, or operate in environments where axios defaults to the fetch adapter. Consequently, the software may send or receive data bodies that exceed the defined maxContentLength or maxBodyLength limits.

This issue can lead to resource exhaustion, such as memory, CPU, or network depletion, particularly in server-side environments. This happens when a compromised or malicious server returns an oversized response, when an attacker provides a large data: URL, or when an application forwards attacker-controlled request bodies while relying on maxBodyLength as a security boundary.

Recommendations Update Axios versions 1.7.0 through 1.15.x to version 1.16.0. As a temporary workaround, use the Node.js http adapter for server-side requests where finite size limits are security-relevant. Validate or cap attacker-controlled request bodies before passing them to axios. Reject or strictly allowlist attacker-controlled URL schemes, specifically data: URLs, before calling axios.