CVE-2026-44488: Axios: Allocation of Resources Without Limits or Throttling in axios

Synopsis

An allocation-without-limits vulnerability in Axios (the Node.js and browser HTTP client) allows configured size limits to be silently bypassed when the fetch adapter is in use. The flaw is reachable over the network with no authentication required, meaning any remote party that can influence response bodies or request payloads can trigger it. Successful exploitation causes resource exhaustion on the affected Node.js server, resulting in service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are published to supported registries.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; either by acting as a malicious remote server returning an oversized response, or by supplying attacker-controlled data to an application that uses Axios to forward requests.

• AuthenticationNot required

  No credentials or session token are needed; the bypass is triggered purely by the size and content of network-delivered payloads.

• Victim interactionNot required

  No user action is required; the vulnerable code path executes server-side whenever Axios makes an outbound request through the fetch adapter.

• Attack complexityDetail

  Exploit reliability is high and condition-free; no race conditions, memory layout knowledge, or environmental tuning are needed to trigger the size-limit bypass.

Blast Radius

• An attacker controlling a remote server can return an arbitrarily large response body, exhausting heap memory or open file descriptors on the Node.js process.
• An attacker who can supply a large data: URL causes Axios to process it without enforcing maxContentLength, consuming CPU and memory until the process stalls or crashes.
• An application that forwards attacker-controlled request bodies through Axios while relying on maxBodyLength as a safety boundary will transmit oversized payloads, potentially overwhelming downstream services as well.
• In all cases the direct outcome is denial of service against the server-side process running the affected Axios version; confidentiality and data integrity are not directly affected.