7.5

CVE-2025-58754: axios

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2025-58754DEBIAN-CVE-2025-58754CGA-2423-7jvr-hjmx
Published 12-09-2025Last modified 16-01-2026
Open JSON

Vulnerability summary

CVE-2025-58754 is a high (CVSS 7.5) vulnerability in axios. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.14%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 6
RHSA-2025:23069CGA-82CQ-C7R6-Q67XCGA-G599-6C37-MMM7CGA-JW4W-H92G-894CCGA-PVGV-P58W-27VJCGA-Q8CH-84QH-R7R2

Timeline

  1. 12-09-2025
    PublishedVulnerability first disclosed.
  2. 16-01-2026
    Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.14%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

0.00 pp

From 1.14% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Axios

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard72 products
  • airflow-2< 2.11.0-r15
  • awx< 24.6.1-r42
  • gitlab-rails-ce-18.1< 18.1.6-r32
  • gitlab-rails-ce-18.10All versions (No fix recorded)
  • gitlab-rails-ce-18.11< 18.11.6-r7
Wolfi33 products
  • grafana-image-renderer< 4.0.15-r1
  • jitsucom-jitsu< 2.11.0-r2
  • jitsucom-jitsu-console< 2.11.0-r2
  • jitsucom-jitsu-rotor< 2.11.0-r2
  • katib-earlystopping< 0.19.0-r31
Axios1 product
  • axios≥ 0.28.0, < 0.30.2 | < 0.30.2 | ≥ 1.0.0, < 1.12.0
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.12.1+dfsg-1
Npm1 product
  • axios≥ 1.0.0, < 1.12.0 | ≥ 0.28.0, < 0.30.2
Ubuntu1 product
  • node-axiosAll versions (No fix recorded)

6 vendors · 109 products

References

14 links
Show all 14 references