CVE-2025-58754: Axios Vulnerability Puts Node.js Processes at Risk of DoS Attacks

CVE-2025-58754 has been disclosed for Axios, a popular promise-based HTTP client used in Node.js and browsers, with a CVSS score of 7.5. According to the advisory, when Axios runs on Node.js and is given a data: URL, it does not perform HTTP and instead decodes the entire payload into memory, potentially returning a synthetic 200 response, which can lead to a DoS if an attacker supplies a very large data: URI.

The flaw resides in the fromDataURI function, which decodes the entire Base64 payload into a Buffer without size checks, meaning that protections like maxContentLength and maxBodyLength used for HTTP streams do not apply to data: URIs. A proof-of-concept has been published showing an out-of-memory crash could be triggered by a single crafted request.

Affected versions are Axios <1.11.0, with a patch available in 1.12.0, and users are urged to upgrade immediately, while remediation guidance emphasises enforcing size limits and using a streaming Base64 decoder to process payloads incrementally.