CVE-2025-58754 Explained: Impact, Exploitation Risks, Detection, and Fix

By Abdul Shakoor

At first glance, CVE-2025-58754 looks like a routine denial-of-service bug in a popular JavaScript library. Look closer, though, and you’ll find a near-perfect storm: a massively adopted dependency, a zero-barrier attack path, and the kind of silent misconfiguration that many teams don’t discover until production goes dark.

This is one of those vulnerabilities that’s trivial to fix and surprisingly easy to overlook — which is exactly the combination that gets services taken offline. Here’s the full picture: what it is, how an attack works, how to detect it, and how to shut it down.

What is CVE-2025-58754?

CVE-2025-58754 is a Denial of Service (DoS) vulnerability in Axios, the widely-used promise-based HTTP client for Node.js and browsers. Published on September 12, 2025, it carries a CVSS v3.1 base score of 7.5 (High) from the National Vulnerability Database (NVD).

The flaw lives in how Axios handles data: scheme URLs on Node.js. Instead of making an actual HTTP request — which would be subject to size enforcement — Axios decodes the entire payload directly into memory as a Buffer or Blob, bypassing the maxContentLength and maxBodyLength limits entirely. An attacker who can supply a large data: URI crashes the Node.js process.

Field	Detail
CVE ID	CVE-2025-58754
Affected Library	Axios (npm)
Affected Versions	0.28.0 – 0.30.1 and 1.x – 1.11.x
Patched Versions	0.30.2 and 1.12.0
CVSS Score	7.5 (High)
CWE	CWE-770: Allocation of Resources Without Limits or Throttling
Attack Vector	Network — no auth, no user interaction required
Impact	Availability only (DoS / OOM crash)

📌 Why this one matters: Why this one matters: The dangerous combination here is high adoption plus zero authentication. Axios is in millions of projects, and this attack needs no login, no user interaction, and no special skill — just one oversized request to an exposed endpoint.

Technical Overview

When Axios gets a standard https:// URL on Node.js, it performs a real HTTP request and enforces your configured size limits. When it gets a data: URL, something different happens — the Node adapter calls an internal helper, from Data URI(), which decodes the Base64 payload directly into memory.

The problem: fromDataURI() in vulnerable versions never consults maxContentLength or maxBodyLength. Those guards only apply to the HTTP response path. The data: code path is completely unguarded.

The affected code sits in lib/adapters/http.js. The fix in versions 0.30.2 and 1.12.0 introduces estimateDataURLDecodedBytes(), which checks the payload size against configured limits before allocating memory. Notably, the bug also affects requests using responseType: 'stream' — developers who assumed stream mode would prevent full buffering were wrong here.

How an Attack Could Work

How the Attack Unfolds: From Recon to Crash

The attack moves through four stages — identifying that a target uses Axios, finding an endpoint that accepts user URLs, sending an oversized data: URI, and repeating it to keep the service down. Each step takes surprisingly little effort.

The attack unfolds in four stages, and what’s striking is how little effort each one takes.

Stage 1 — Reconnaissance.

The attacker confirms the target uses Axios. This is surprisingly easy: package lock files in public GitHub repos, stack traces in error responses, or framework-specific HTTP headers all give it away.

Stage 2 — Finding the attack surface.

The attacker looks for any endpoint where user-supplied input reaches an Axios call — link preview generators, webhook resolvers, media fetchers, proxy endpoints. If the application passes a user-provided URL to axios.get() without scheme validation, the path is open.

Stage 3 — Triggering the crash.

The attacker submits a data: URI with a massive Base64 payload — hundreds of megabytes or more. Axios calls from Data URI(), Node.js tries to allocate the memory in one synchronous operation, the heap fills, and the process crashes.

Stage 4 — Persistent disruption.

Because no authentication is required, the attack is repeatable. In auto-scaling environments, this can also generate significant unexpected compute costs as infrastructure cycles through crash-restart loops.

Exploitation status

CISA’s advisory classification marks this with exploitation status “PoC” — a public proof-of-concept exists. That matters because PoC availability shortens the gap between disclosure and real-world exploitation attempts. Attackers don’t need to reverse-engineer anything.

The attack is constrained to DoS only — no data exfiltration, no remote code execution. But a persistent, zero-authentication crash path against a production service is a serious operational risk regardless. The low attack complexity combined with no privileges required makes this straightforward for any attacker who can reach an exposed endpoint.

Open source ecosystem impact

The GitHub Security Advisory (GHSA-4hjh-wcwx-xvwj) was published September 11, 2025. Teams with Depend a bot enabled received automatic alerts. Teams without active dependency scanning had no automated signal — their exposure window depended entirely on manual processes.

Snyk, npm audit, and GitHub Dependabot all detect CVE-2025-58754 for any project on an affected Axios version. The important nuance: SCA tools flag the vulnerability regardless of whether your application actually accepts user-supplied URLs. A Snyk alert here warrants investigation to understand your specific attack surface, not just a reflexive update click.

Axios is also commonly pulled in as a transitive dependency — meaning you may be exposed through a third-party package that wraps Axios internally. npm ls axios (not npm list) shows the full dependency tree, including indirect references.

Business Impact

For security teams that need to communicate risk upward, here’s how this translates beyond the code.

Operational:

A crash-loop in one Node.js microservice can propagate failures to dependent services through timeout chains. In API-heavy architectures, a single vulnerable endpoint can be leveraged to destabilize a broader system.

Financial:

Downtime costs money — SLA penalties, support overhead, revenue loss during outages, and unexpected cloud compute costs from auto-scaling restart cycles.

Compliance:

PCI-DSS, HIPAA, and FedRAMP all carry availability requirements. A known-unpatched High-severity CVE in a production dependency past your remediation SLA is a documentable compliance gap.

Supply Chain:

Any third-party vendor or integration partner running a vulnerable Axios version extends your exposure surface beyond your own codebase.

Detection Guidance

Exploiting CVE-2025-58754 looks like a normal HTTP request at the network perimeter — the malicious content is inside the payload. That means perimeter defences like a basic firewall won’t catch it on their own; detection has to happen closer to the application. (It’s a good reminder of why layered defence matters — and if you’re shaky on that foundation, our guide on how firewalls protect networks covers where perimeter controls do and don’t help.)

Watch for these signals: unexplained Node.js OOM crashes correlated with recent inbound requests; FATAL ERROR: Reached heap limit messages in process logs; crash-restart loops in containers or pods; and sudden heap memory spikes in your APM dashboards.

For SIEM, build a correlation rule: a Node.js crash event plus access log entries containing data: in parameters or request bodies within a short time window. That pairing is a strong indicator worth investigating.

If you haven’t patched, do a manual code review tracing every code path where external input could influence what URL reaches an Axios call.

Fix and Remediation

The good news: the fix itself is a single command. Here’s the full process.

Step 1 — Check your version:

bash

npm list axios

Any version between 0.28.0–0.30.1 or 1.x–1.11.x is affected.

Step 2 — Update:

bash

npm install axios@1.12.0    # for 1.x branch
npm install axios@0.30.2    # for legacy 0.x branch

Step 3 — Check transitive dependencies:

bash

npm ls axios

Confirm all entries in the full tree show a patched version.

Interim mitigation

(if you can’t patch immediately): add a request interceptor to reject data: scheme URLs before they reach Axios processing:

javascript

axios.interceptors.request.use((config) => {
  if (config.url && config.url.startsWith('data:')) {
    return Promise.reject(new Error('data: URIs are not permitted'));
  }
  return config;
});

Long-term: Implement URL scheme allowlisting (http and https only) at the application layer before any user-supplied URL reaches an HTTP client. This protects against this whole class of vulnerability regardless of the underlying library’s behavior — the same defence-in-depth thinking behind solid API security practices.

✅ Best practice: Patching fixes this bug. Scheme allowlisting fixes the category of bug. Do both — update Axios now, and add validation so the next library-level surprise in this class can’t touch you.

Long-term:

Implement URL scheme allowlisting (http and https only) at the application layer before any user-supplied URL reaches an HTTP client. This protects against this class of vulnerability regardless of the underlying library’s behavior.

Comparison with similar Axios vulnerabilities

Vulnerability	Type	CVSS	Key Risk
CVE-2025-58754	DoS (Memory Exhaustion)	7.5	Unbounded memory via data: URI crashes Node.js
CVE-2025-27152	SSRF	High	Absolute URLs bypass baseURL; credential leakage risk
CVE-2026-25639	DoS (TypeError crash)	7.5	__proto__ in mergeConfig crashes process via JSON.parse() input
CVE-2024-39338	SSRF	7.5	Path-relative URLs treated as protocol-relative; bypasses baseURL

CVE-2025-27152 and CVE-2024-39338 both attack Axios’s URL trust boundary to enable SSRF — qualitatively more dangerous because they threaten confidentiality and enable lateral movement to internal services. CVE-2026-25639 is a DoS variant in a different code path: the mergeConfig function crashes when processing __proto__ keys from JSON.parse() input, fixed in 1.13.5.

Together these four CVEs show a pattern: Axios has grown in complexity faster than its security review has kept pace. The team ships patches consistently, but the frequency of high-severity disclosures signals the library’s input handling needs deeper architectural review. If you build with Axios, treating each new disclosure as routine maintenance — not a fire drill — is the healthier mindset.

Frequently Asked Questions

Conclusion

CVE-2025-58754 is a textbook dependency security failure: a single missing size check in an edge-case code path creates a zero-authentication, network-accessible path to crash production services. The fix takes one command. The harder work — building continuous dependency monitoring, defining remediation SLAs, and treating third-party libraries as infrastructure you’re responsible for — is ongoing.

Update Axios to 1.12.0 or 0.30.2 now. Add scheme validation to your URL-handling code. And don’t wait for the next Axios CVE to find out you were exposed.

For related reading, explore our guides on how firewalls protect networks, RASP tools, API security, and how hackers reverse engineer apps.