CVE-2026-44488 axios CVE debrief

Who should care

Defenders of applications using axios versions 1.7.0 through 1.15.x with the fetch adapter should assess exposure and prioritize upgrading to axios versions 0.32.0 or 1.16.0. Roles that should assess exposure include developers and administrators of applications using axios versions 1.7.0 through 1.15.x with the fetch adapter.

Why it matters

Defenders should care about CVE-2026-44488 because it can lead to resource exhaustion in server-side usage of axios. Roles that should assess exposure include developers and administrators of applications using axios versions 1.7.0 through 1.15.x with the fetch adapter. The supported consequences include resource exhaustion and potential for large data supply by an attacker. Verification of affected versions and remediation priority is necessary.

• Resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response
• Potential for large data: URL supply by an attacker
• Forwarding of attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary

Technical summary

Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This vulnerability can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary.

Defensive priority

Defenders should prioritize upgrading to axios versions 0.32.0 or 1.16.0, or applying compensating controls to limit the size of requests and responses.

Recommended defensive actions

• Upgrade to axios versions 0.32.0 or 1.16.0
• Apply compensating controls to limit the size of requests and responses
• Monitor for large requests and responses
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. The axios advisory provides details on the fix. Evidence limits are based on available information from the CVE Program and NVD. Affected scope and severity are based on vendor guidance and CVE metadata. Defenders should verify affected versions and remediation priority.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.