Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | General1 |
| 2026-05-05 | 1 | Disclosure1 |
🟠 axios, maxContentLength Bypass, #CVE-2026-42036 (Medium) https://dailycve.com/axios-maxcontentlength-bypass-cve-2026-42036-medium/
Post summary
A new medium‑severity vulnerability (CVE‑2026‑42036) in axios involving a maxContentLength bypass has been disclosed; further details are likely available via the provided link.
CVE-2026-42036 Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream w… https://www.cve.org/CVERecord?id=CVE-2026-42036
Post summary
The entry briefly references CVE-2026-42036, noting impacted Axios versions and a behavior when using responseType: 'stream', but offers no further technical detail, exploit information, or remedial guidance.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axios | axios | - | node.js | - |