GitHub Advisoryadvisory · npm
GHSA-42xw-2xvc-qx8m Denial of Service in axios
HIGH
Official page ↗
- Aliases
- CVE-2019-10742
- Ecosystem
- npm
- Packages
- axios
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-20, CWE-755
- Reviewed
- 2019-05-14
Affected packages
• npm axios: < 0.18.1 → fixed in 0.18.1
Description
Versions of `axios` prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the `maxContentLength` property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service.
Recommendation
Upgrade to 0.18.1 or later.
Related
Alias · CVE (1)
- CVE-2019-10742 Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10742 advisory
- https://github.com/axios/axios/issues/1098 web
- https://github.com/axios/axios/pull/1485 web
- https://github.com/axios/axios/commit/acabfbdf00a58bb866c9d070e8a10d1d0dbeb572 web
- https://app.snyk.io/vuln/SNYK-JS-AXIOS-174505 web
- https://snyk.io/vuln/SNYK-JS-AXIOS-174505 web
- https://www.npmjs.com/advisories/880 web