Axios Vulnerability Enables Attackers to Crash Node.js Applications via Data Handle Abuse

A critical security vulnerability in the Axios HTTP client library allows attackers to crash Node.js applications by abusing data URLs, tracked as CVE-2025-58754. The flaw affects all versions before 1.11.0 and has a CVSS 3.1 score of 7.5, marking it as high severity. It stems from Axios’s handling of data URLs in Node.js, where the library decodes the entire Base64 payload into memory using Buffer allocation, bypassing normal HTTP processing and the configured safety limits for maxContentLength and maxBodyLength.

Exploitation requires no authentication or user interaction; attackers only need the ability to supply URLs to vulnerable Axios installations, and proof-of-concept shows payloads can rapidly consume memory and trigger out-of-memory crashes. The Axios team released a patched version, 1.12.0, which enforces proper size validation for data URL payloads, and organisations are advised to upgrade or apply mitigations such as application-level data URL validation.

The article notes that this vulnerability can affect availability even when streaming configurations and memory protection are in place, highlighting the importance of timely updates.