CVE-2019-10742 Denial of Service in axios

High 7.5 Published 7 May 2019 Updated 4 Aug 2024

Attackers can crash applications using the Axios library by sending responses that exceed the configured maximum content length.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10742?

CVE-2019-10742 is a high-severity denial of service vulnerability in axios, published on 7 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Weakness: CWE-755

Which versions are affected by CVE-2019-10742?

2 open source packages ship an affected version, including axios. It affects 1 product.

Package	Affected	Fixed in
`axios` npm	All versions	`0.18.1`
`axios` npm	All versions	`0.18.1`

Products include Axios Axios.

How do I fix CVE-2019-10742?

Upgrade axios to 0.18.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-10742 being exploited?

There is no known exploitation of CVE-2019-10742 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as DEBIAN-CVE-2019-10742, GHSA-42xw-2xvc-qx8m.