CVE-2026-42036
Axios: HTTP adapter streamed responses bypass maxContentLength
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Axios: HTTP adapter streamed responses bypass maxContentLength
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Record
CVE-2026-42036- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-25602
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Record
EUVD-2026-25602- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vf2m-468p-8v99
Axios: HTTP adapter streamed responses bypass maxContentLength
Summary
When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
Details
In lib/adapters/http.js:
- 786-789: for responseType === 'stream', Axios immediately settles with the stream.
- 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.
So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.
PoC
Environment:
- Axios main at commit f7a4ee2
- Node v24.2.0
Steps:
- Start an HTTP server that returns a 2 MiB response body.
- Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
- Read the returned stream fully.
Observed:
- Success; full 2097152 bytes readable.
Control check:
- Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.
Impact
Type: DoS / unbounded response processing. Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.
- Record
GHSA-vf2m-468p-8v99- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Record
CVE-2026-42036- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Axios: HTTP adapter streamed responses bypass maxContentLength
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Record
CVE-2026-42036- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-42036
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Record
DEBIAN-CVE-2026-42036- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 20 moreShow less
OSVGHSA-vf2m-468p-8v99
Axios: HTTP adapter streamed responses bypass maxContentLength
Summary
When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
Details
In lib/adapters/http.js:
- 786-789: for responseType === 'stream', Axios immediately settles with the stream.
- 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.
So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.
PoC
Environment:
- Axios main at commit f7a4ee2
- Node v24.2.0
Steps:
- Start an HTTP server that returns a 2 MiB response body.
- Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
- Read the returned stream fully.
Observed:
- Success; full 2097152 bytes readable.
Control check:
- Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.
Impact
Type: DoS / unbounded response processing. Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.
- Record
GHSA-vf2m-468p-8v99- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-42036
CVE-2026-42036 in axios - Patched by Root
Root has patched CVE-2026-42036 in the axios package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-42036- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-42036
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
- Record
UBUNTU-CVE-2026-42036- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1782521951 No score
TuxCare security update for axios (17 CVEs)
TuxCare rebuilt axios to address 17 CVEs. Fixed in 0.19.2-tuxcare.1.
- Record
CLSA-2026-1782521951- Updated
- 2026-11-02
OSVCLSA-2026-1782781178 No score
TuxCare security update for axios (16 CVEs)
TuxCare rebuilt axios to address 16 CVEs. Fixed in 0.21.1-tuxcare.1.
- Record
CLSA-2026-1782781178- Updated
- 2026-11-02
OSVCLSA-2026-1782867613 No score
TuxCare security update for axios (15 CVEs)
TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.21.4-tuxcare.1.
- Record
CLSA-2026-1782867613- Updated
- 2026-11-02
OSVCLSA-2026-1783040460 No score
TuxCare security update for axios (15 CVEs)
TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.24.0-tuxcare.1.
- Record
CLSA-2026-1783040460- Updated
- 2026-11-02
OSVCLSA-2026-1783299714 No score
TuxCare security update for axios (15 CVEs)
TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.1-tuxcare.1.
- Record
CLSA-2026-1783299714- Updated
- 2026-11-02
OSVCLSA-2026-1784769505 No score
TuxCare security update for axios (18 CVEs)
TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.7-tuxcare.3.
- Record
CLSA-2026-1784769505- Updated
- 2026-11-02
OSVCLSA-2026-1784769531 No score
TuxCare security update for axios (18 CVEs)
TuxCare rebuilt axios to address 18 CVEs. Fixed in 1.7.5-tuxcare.2.
- Record
CLSA-2026-1784769531- Updated
- 2026-11-02
OSVCLSA-2026-1784856205 No score
TuxCare security update for axios (21 CVEs)
TuxCare rebuilt axios to address 21 CVEs. Fixed in 1.7.9-tuxcare.1.
- Record
CLSA-2026-1784856205- Updated
- 2026-11-02
OSVCLSA-2026-1785468080 No score
TuxCare security update for axios (15 CVEs)
TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4.
- Record
CLSA-2026-1785468080- Updated
- 2026-11-02
OSVCLSA-2026-1787796805 No score
TuxCare security update for axios (4 CVEs)
TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.18.1-tuxcare.5.
- Record
CLSA-2026-1787796805- Updated
- 2026-11-02
OSVCLSA-2026-1787930357 No score
TuxCare security update for axios (13 CVEs)
TuxCare rebuilt axios to address 13 CVEs. Fixed in 0.27.2-tuxcare.5.
- Record
CLSA-2026-1787930357- Updated
- 2026-11-02
OSVCLSA-2026-1790764333 No score
TuxCare security update for axios (28 CVEs)
TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.
- Record
CLSA-2026-1790764333- Updated
- 2026-11-02
OSVCLSA-2026-1793101806 No score
TuxCare security update for axios (6 CVEs)
TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.18.0-tuxcare.2.
- Record
CLSA-2026-1793101806- Updated
- 2026-11-06
OSVCLSA-2026-1793101832 No score
TuxCare security update for axios (11 CVEs)
TuxCare rebuilt axios to address 11 CVEs. Fixed in 0.21.2-tuxcare.2.
- Record
CLSA-2026-1793101832- Updated
- 2026-11-06
OSVCLSA-2026-1793101849 No score
TuxCare security update for axios (32 CVEs)
TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.
- Record
CLSA-2026-1793101849- Updated
- 2026-11-02
OSVCLSA-2026-1793110604 No score
TuxCare security update for axios (32 CVEs)
TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.
- Record
CLSA-2026-1793110604- Updated
- 2026-11-02
OSVCLSA-2026-1793874599 No score
TuxCare security update for axios (27 CVEs)
TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.
- Record
CLSA-2026-1793874599- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
axiosnpm |
1.0.0 up to 1.15.1 | 1.15.1 |
axiosnpm |
through 0.31.0 | 0.31.1 |
axiosTuxCare:npm From an advisory covering 17 CVEs |
0.19.2-tuxcare.0 up to 0.19.2-tuxcare.1, plus listed versions 0.19.2 |
0.19.2-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 16 CVEs |
0.21.1-tuxcare.0 up to 0.21.1-tuxcare.1, plus listed versions 0.21.1 |
0.21.1-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 15 CVEs |
0.21.4-tuxcare.0 up to 0.21.4-tuxcare.1, plus listed versions 0.21.4 |
0.21.4-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 15 CVEs |
0.24.0-tuxcare.0 up to 0.24.0-tuxcare.1, plus listed versions 0.24.0 |
0.24.0-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 15 CVEs |
0.26.1-tuxcare.0 up to 0.26.1-tuxcare.1, plus listed versions 0.26.1 |
0.26.1-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 18 CVEs |
1.7.7-tuxcare.0 up to 1.7.7-tuxcare.3, plus listed versions 1.7.71.7.7-tuxcare.11.7.7-tuxcare.2 |
1.7.7-tuxcare.3 |
axiosTuxCare:npm From an advisory covering 18 CVEs |
1.7.5-tuxcare.0 up to 1.7.5-tuxcare.2, plus listed versions 1.7.51.7.5-tuxcare.1 |
1.7.5-tuxcare.2 |
axiosTuxCare:npm From an advisory covering 21 CVEs |
1.7.9-tuxcare.0 up to 1.7.9-tuxcare.1, plus listed versions 1.7.9 |
1.7.9-tuxcare.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
axiosTuxCare:npm From an advisory covering 14 CVEs |
0.26.0-tuxcare.0 up to 0.26.0-tuxcare.4, plus listed versions 0.26.00.26.0-tuxcare.10.26.0-tuxcare.20.26.0-tuxcare.3 |
0.26.0-tuxcare.4 |
axiosTuxCare:npm From an advisory covering 4 CVEs |
0.18.1-tuxcare.0 up to 0.18.1-tuxcare.5, plus listed versions 0.18.10.18.1-tuxcare.10.18.1-tuxcare.20.18.1-tuxcare.30.18.1-tuxcare.4 |
0.18.1-tuxcare.5 |
axiosTuxCare:npm From an advisory covering 13 CVEs |
0.27.2-tuxcare.0 up to 0.27.2-tuxcare.5, plus listed versions 0.27.20.27.2-tuxcare.10.27.2-tuxcare.20.27.2-tuxcare.30.27.2-tuxcare.4 |
0.27.2-tuxcare.5 |
axiosTuxCare:npm From an advisory covering 28 CVEs |
1.13.5-tuxcare.0 up to 1.13.5-tuxcare.1, plus listed versions 1.13.5 |
1.13.5-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 6 CVEs |
0.18.0-tuxcare.0 up to 0.18.0-tuxcare.2, plus listed versions 0.18.00.18.0-tuxcare.1 |
0.18.0-tuxcare.2 |
axiosTuxCare:npm From an advisory covering 11 CVEs |
0.21.2-tuxcare.0 up to 0.21.2-tuxcare.2, plus listed versions 0.21.20.21.2-tuxcare.1 |
0.21.2-tuxcare.2 |
axiosTuxCare:npm From an advisory covering 32 CVEs |
1.13.2-tuxcare.0 up to 1.13.2-tuxcare.2, plus listed versions 1.13.21.13.2-tuxcare.1 |
1.13.2-tuxcare.2 |
axiosTuxCare:npm From an advisory covering 32 CVEs |
1.12.2-tuxcare.0 up to 1.12.2-tuxcare.1, plus listed versions 1.12.2 |
1.12.2-tuxcare.1 |
axiosTuxCare:npm From an advisory covering 27 CVEs |
1.13.6-tuxcare.0 up to 1.13.6-tuxcare.3, plus listed versions 1.13.61.13.6-tuxcare.11.13.6-tuxcare.2 |
1.13.6-tuxcare.3 |
node-axiosDebian:12 |
All versions, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.1+dfsg-11.13.2+dfsg-11.14.0+dfsg-1 Show 17 moreShow less1.15.0-11.15.2-11.16.0-11.18.0-11.19.0-11.2.1+dfsg-11.2.1+dfsg-1+deb12u11.20.0-11.5.1+dfsg-11.6.2+dfsg-11.6.8+dfsg-11.6.8+dfsg-21.7.3+dfsg-11.7.4+dfsg-11.7.7+dfsg-11.7.9+dfsg-11.8.4+dfsg-1 |
None known |
node-axiosDebian:13 |
All versions, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.1+dfsg-11.13.2+dfsg-11.14.0+dfsg-1 Show 7 moreShow less1.15.0-11.15.2-11.16.0-11.18.0-11.19.0-11.20.0-11.8.4+dfsg-1 |
None known |
node-axiosDebian:14 |
before 1.15.2-1, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.1+dfsg-11.13.2+dfsg-11.14.0+dfsg-11.15.0-11.8.4+dfsg-1 |
1.15.2-1 |
axiosnpm |
before 0.31.1 | 0.31.1 |
axiosRoot:npm |
before 1.13.5-aikido.6 | 1.13.5-aikido.61.12.0-aikido.81.13.5-aikido.71.13.2-aikido.71.13.5-aikido.81.12.1-aikido.181.13.5-aikido.91.13.5-aikido.101.12.0-aikido.91.13.2-aikido.81.8.4-aikido.91.12.0-aikido.100.21.4-aikido.71.12.1-aikido.191.13.5-aikido.111.13.2-aikido.91.13.5-aikido.121.13.4-aikido.60.21.4-aikido.61.12.1-aikido.200.21.4-aikido.81.13.5-aikido.131.13.4-aikido.71.8.4-aikido.101.12.0-aikido.111.13.2-aikido.100.21.1-aikido.51.2.1-aikido.41.15.0-aikido.91.15.0-aikido.101.15.0-aikido.111.14.0-aikido.71.15.0-aikido.120.27.2-aikido.80.27.2-aikido.90.27.2-aikido.101.14.0-aikido.81.14.0-aikido.91.14.0-aikido.101.12.2-aikido.71.7.9-aikido.91.7.9-aikido.101.13.4-aikido.81.8.3-aikido.81.15.0-aikido.131.13.2-aikido.111.12.0-aikido.121.7.9-aikido.111.8.4-aikido.111.13.5-aikido.141.8.3-aikido.91.14.0-aikido.111.2.1-aikido.51.12.2-aikido.81.15.0-aikido.141.12.2-aikido.91.12.2-aikido.101.12.2-aikido.110.21.4-aikido.91.7.9-aikido.120.27.2-aikido.111.13.2-aikido.121.7.7-aikido.21.8.4-aikido.121.7.9-aikido.131.15.1-aikido.11.15.1-aikido.2 |
@rootio/axiosRoot:npm |
before 1.13.5-root.io.5 | 1.13.5-root.io.51.12.0-root.io.71.13.2-root.io.61.13.5-root.io.61.12.0-root.io.81.13.5-root.io.71.13.2-root.io.71.13.5-root.io.81.12.1-root.io.181.13.5-root.io.91.13.5-root.io.101.12.0-root.io.91.13.2-root.io.81.8.4-root.io.91.12.0-root.io.100.21.4-root.io.71.12.1-root.io.191.13.5-root.io.111.13.2-root.io.91.13.5-root.io.121.13.4-root.io.60.21.4-root.io.61.12.1-root.io.200.21.4-root.io.81.13.5-root.io.131.13.4-root.io.71.8.4-root.io.101.12.0-root.io.111.13.2-root.io.100.21.1-root.io.51.2.1-root.io.41.15.0-root.io.91.15.0-root.io.101.15.0-root.io.111.14.0-root.io.71.15.0-root.io.120.27.2-root.io.80.27.2-root.io.90.27.2-root.io.101.14.0-root.io.81.14.0-root.io.91.14.0-root.io.101.12.2-root.io.71.7.9-root.io.91.7.9-root.io.101.13.4-root.io.81.8.3-root.io.81.15.0-root.io.131.13.2-root.io.111.12.0-root.io.121.7.9-root.io.111.8.4-root.io.111.13.5-root.io.141.8.3-root.io.91.14.0-root.io.111.2.1-root.io.51.12.2-root.io.81.15.0-root.io.141.12.2-root.io.91.12.2-root.io.101.12.2-root.io.110.21.4-root.io.91.7.9-root.io.120.27.2-root.io.111.13.2-root.io.121.7.7-root.io.21.8.4-root.io.121.7.9-root.io.131.15.1-root.io.11.15.1-root.io.2 |
node-axiosUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 0.19.0+dfsg-20.19.0+dfsg-2ubuntu0.1~esm1 |
None known |
node-axiosUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 0.21.1+dfsg-10.23.0+dfsg-20.24.0+dfsg-10.25.0+dfsg-20.26.0+dfsg-10.26.0+dfsg-1ubuntu0.1~esm1 |
None known |
node-axiosUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.2.1+dfsg-11.5.1+dfsg-11.6.2+dfsg-11.6.8+dfsg-21.6.8+dfsg-2ubuntu0.1~esm1 |
None known |
node-axiosUbuntu:25.10 |
All versions, plus listed versions 1.7.9+dfsg-11.8.4+dfsg-11.11.0+dfsg-1 |
None known |
node-axiosUbuntu:26.10 |
All versions, plus listed versions 1.13.2+dfsg-1build11.16.0-11.18.0-11.19.0-1 |
None known |
node-axiosUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 1.11.0+dfsg-11.12.1+dfsg-11.13.2+dfsg-1build11.13.2+dfsg-1ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected | OSV | |
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42036 is a medium vulnerability (CVSS 5.3) in Axios, published April 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in axios 1.15.1.
References
github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99
nvd.nist.gov/vuln/detail/CVE-2026-42036
security-tracker.debian.org/tracker/CVE-2026-42036
ubuntu.com/security/CVE-2026-42036
cve.org/CVERecord?id=CVE-2026-42036