When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
In lib/adapters/http.js:
- 786-789: for responseType === 'stream', Axios immediately settles with the stream.
- 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.
So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.
Environment:
- Axios main at commit f7a4ee2
- Node v24.2.0
Steps:
Observed:
- Success; full 2097152 bytes readable.
Control check:
- Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.
Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.
| Score | Percentile |
|---|---|
| 0.05% | 15.73% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.3 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-vf2m-468p-8v99 ↗ |
| CVE | CVE-2026-42036 ↗ |
| CWE id | Name |
|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | axios | >= 1.0.0, < 1.15.1 | 1.15.1 | — |
| npm | axios | <= 0.31.0 | 0.31.1 | — |