Axios Vulnerability Could Allow Attackers to Crash Node.js Processes via Malicious Data Handling

A critical denial-of-service flaw in the popular Axios HTTP client for Node.js was disclosed yesterday under advisory GHSA-4hjh-wcwx-xvwj by maintainer Jason Saayman.

The vulnerability arises from how Axios decodes data: URLs, allowing an attacker to trigger unbounded memory allocation and crash Node.js processes.

Users running Axios versions below 1.11.0 are urged to upgrade to 1.12.0 immediately to mitigate potential service outages.

URL Decode Flaw

Axios is widely used in Node.js applications to simplify HTTP requests, streaming, and response handling.

When encountering a URL prefixed with the data: scheme, Axios bypasses its HTTP adapter’s normal network call path and instead invokes a local decoder to transform the embedded Base64 payload into memory.

This decoding routine constructs a Buffer (or Blob) containing the entire decoded content without enforcing any size constraints or honoring configuration limits such as maxContentLength or maxBodyLength.

Consequently, a malicious actor can submit a data: URL with an arbitrarily large Base64 string to force the Node.js process to consume excessive heap space and crash due to out-of-memory errors.

Technical Details and Proof-of-Concept

In the Axios Node adapter (lib/adapters/http.js), the code checks for the data: protocol and calls fromDataURI() to decode the URI body.

The helper (lib/helpers/fromDataURI.js) slices the prefix, matches the Base64 payload via regex, applies decodeURIComponent, and finally wraps the data in a Buffer.

There is no check against the configured heap limits or streaming safeguards.

For HTTP responses, Axios tracks the cumulative byte count and aborts if it exceeds maxContentLength.

However, the data path entirely sidesteps that logic.

A proof-of-concept script demonstrates this: generating a ~120 MB Base64 string, submitting it as a data: URL, and observing the Node process crash when the heap is capped (e.g., via –max-old-space-size=100).

A mini link-preview Express app further shows how an API endpoint that streams responses can be weaponized by allowing data: URLs, causing service instability in production scenarios.

This vulnerability poses a high-severity risk for any Node.js service that accepts user-provided URLs and uses Axios for fetching or streaming content.

Attackers can remotely trigger full server crashes, resulting in denial of service. Mitigation is straightforward: upgrade Axios to version 1.12.0 or later, where the decoder path now respects maxBodyLength limits.

In environments where an immediate upgrade is not feasible, organizations should implement input validation to reject data: URLs or sanitize user-supplied URIs before passing them to Axios.

Additionally, setting strict memory quotas at the container or process level can limit the blast radius of an attack.

Library maintainers are advised to audit other non-HTTP protocol handlers for similar oversight, ensuring that all entry points enforce consistent resource constraints.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates

The post Axios Vulnerability Could Allow Attackers to Crash Node.js Processes via Malicious Data Handling appeared first on Cyber Security News.