5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42036

CVE-2026-42036: Axios: HTTP adapter streamed responses bypass maxContentLength

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing. Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42036

CVE-2026-42036:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
axios	npm	>= 1.0.0, < 1.15.1	1.15.1
axios	npm	<= 0.31.0	0.31.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in GHSA-vf2m-468p-8v99, allows for a denial-of-service attack by bypassing the maxContentLength check when using streamed responses in Axios on Node.js. By analyzing the patches between the vulnerable version 1.15.0 and the fixed version 1.15.1, I identified commit e8904af03385b040e53f1263a444e825db4335d9 as the security fix. The commit specifically addresses the issue by adding logic to enforce maxContentLength for streamed responses within the httpAdapter function in lib/adapters/http.js. Before the patch, the if (responseType === 'stream') block would pass the raw response stream to the user, ignoring the size limit. The fix intercepts this process, wrapping the stream to enforce the length constraint. Therefore, the httpAdapter is the precise location of the vulnerability.

Vulnerable functions

httpAdapter

lib/adapters/http.js

The vulnerability exists within the main exported function of the `lib/adapters/http.js` file, which acts as the HTTP adapter for Node.js environments. When a user requests a response with `responseType: 'stream'`, the code previously would directly return the response stream without validating its size against the `maxContentLength` configuration. The patch introduces an `enforceMaxContentLength` async generator function that wraps the original stream to monitor the data size and throws an error if it exceeds the configured limit. The vulnerable function is the adapter function itself, as it contained the logic that bypassed this crucial security check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.