Node axios: Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. (CVE-2026-44488)

Axios, a promise-based HTTP client for browser and Node.js, versions 1.7.0 through 1.15.x failed to enforce the configured maximum request and response body size limits when requests were sent using the fetch adapter. This flaw allowed applications that explicitly set maxContentLength or maxBodyLength to send or receive bodies exceeding those limits. Such behavior could cause resource exhaustion on the server side if a malicious or compromised server returns an oversized response, if an attacker supplies a large data URL, or if attacker-controlled request bodies are forwarded relying on maxBodyLength as a boundary. The vulnerability has been addressed and fixed in Axios versions 0.32.0 and 1.16.0.

The vulnerability can lead to resource exhaustion in server-side environments by allowing oversized request or response bodies to bypass configured size limits. This could degrade service availability or cause denial of service conditions. There is no direct impact on confidentiality or integrity reported.

A fix is available in Axios versions 0.32.0 and 1.16.0. Users should upgrade to these or later versions to ensure that configured request and response size limits are properly enforced when using the fetch adapter.