Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-44488 high CVSS 7.5

Vulnerability in axios (CVE-2026-44488)

Summary

Vulnerability in axios (CVE-2026-44488). Risk of unauthorized operations or information disclosure. Exploitable via fetch. Mitigation: upgrade to 1.16.0 or later.

Original description

The description as published by the source.

Summary

Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured.

This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary.

Impact

The impact is availability-only. Affected applications may process, buffer, or transmit data beyond the configured limit, potentially exhausting memory, CPU, or network resources.

This does not affect axios’s default unlimited behaviour by itself: maxContentLength and maxBodyLength default to -1. The vulnerability exists when an application has configured finite limits and expects axios to enforce them.

Server-side runtimes are the primary concern. Browser impact is generally constrained by the browser process and browser fetch behavior, and should not be described as server process exhaustion.

Affected Functionality

Affected functionality includes requests using the built-in fetch adapter with finite maxContentLength or maxBodyLength values.

Releva…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-44488 has been found in axios.
Attackers can target a specific entry point like fetch over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade axios to 1.16.0 or later.
If unsure, ask your IT team or search "axios CVE-2026-44488" on the vendor's site.

CVE-2026-44488 (axios) — CWE-770 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: fetch / maxContentLength / maxBodyLength / xhr
Patched: 1.16.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-770) exists in axios. Attackers reach the vulnerable code path via fetch without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of axios. Attack surface: fetch / maxContentLength / maxBodyLength / xhr.

🔥 Severity

Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 1.16.0.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'axios' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'axios' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で axios を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade axios to 1.16.0

    ステージング環境で 1.16.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm axios
[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.16.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details