GHSA-58q2-9x27-h2jm solspace/craft-freeform Has a DoS Vulnerability

• Packagist solspace/craft-freeform: < 4.1.30 → fixed in 4.1.30

Summary Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754). Freeform version: 4.1.29 Craft CMS version: 4.16.8 Impact When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj https://github.com/axios/axios/pull/7011 https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 https://github.com/axios/axios/releases/tag/v1.12.0