{"id":"EUVD-2025-28992","revision":"1e90a84146ca4efaa9d4ba5169d0189f","records":[{"revision":"1e90a84146ca4efaa9d4ba5169d0189f","observedAt":"2026-10-27T22:57:44.439+00:00","statement":{"source":"euvd","id":"EUVD-2025-28992","aliases":["CVE-2025-58754","GHSA-4hjh-wcwx-xvwj"],"title":"Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, i…","description":"Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj","https://github.com/axios/axios/pull/7011","https://github.com/axios/axios/pull/7034","https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593","https://github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67","https://github.com/axios/axios/commit/c30252f685e8f4326722de84923fcbc8cf557f06","https://github.com/axios/axios/releases/tag/v0.30.2","https://github.com/axios/axios/releases/tag/v1.12.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-28992","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 12, 2025, 1:16:40 AM","dateUpdated":"Jan 16, 2026, 2:50:09 PM"},"relatedAdvisories":[{"id":"RHSA-2026:4215","title":"Red Hat Security Advisory: Red Hat Quay 3.14.6","vulnerabilityIds":["CVE-2022-30187","CVE-2024-34156","CVE-2024-47081","CVE-2025-12816","CVE-2025-15284","CVE-2025-45768","CVE-2025-47273","CVE-2025-47913","CVE-2025-50181","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-59420","CVE-2025-61729","CVE-2025-61920","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:6226","title":"Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update","vulnerabilityIds":["CVE-2025-47907","CVE-2025-57810","CVE-2025-58183","CVE-2025-58754","CVE-2025-59343","CVE-2025-61726","CVE-2025-61728","CVE-2025-61729","CVE-2025-68121","CVE-2026-27571"]},{"id":"RHSA-2026:41928","title":"Red Hat Security Advisory: Red Hat Migration Toolkit for Containers","vulnerabilityIds":["CVE-2025-7783","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-61726","CVE-2025-61729","CVE-2025-62718","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-68121","CVE-2025-69223","CVE-2025-69227","CVE-2025-69228","CVE-2026-4800","CVE-2026-6322","CVE-2026-9277","CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-21441","CVE-2026-22029","CVE-2026-23490","CVE-2026-23745","CVE-2026-25679","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-29063","CVE-2026-30922","CVE-2026-32280","CVE-2026-32281","CVE-2026-32283","CVE-2026-33186","CVE-2026-33810","CVE-2026-33811","CVE-2026-34986","CVE-2026-39820","CVE-2026-39821","CVE-2026-40895","CVE-2026-42264","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45736","CVE-2026-45822","CVE-2026-48779"]},{"id":"RHSA-2026:1942","title":"Red Hat Security Advisory: Red Hat Quay 3.15.3","vulnerabilityIds":["CVE-2024-34156","CVE-2025-12816","CVE-2025-15284","CVE-2025-47907","CVE-2025-47913","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-59420","CVE-2025-61729","CVE-2025-65945","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2025:19804","title":"Red Hat Security Advisory: RHACS 4.7.8 security and bug fix update","vulnerabilityIds":["CVE-2025-58754"]},{"id":"SSA-485750","title":"SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62522","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610"]},{"id":"RHSA-2026:86618","title":"Red Hat Security Advisory: New container image: rhceph-9.2","vulnerabilityIds":["CVE-2023-46159","CVE-2024-47866","CVE-2024-48916","CVE-2024-55565","CVE-2025-12816","CVE-2025-15599","CVE-2025-26791","CVE-2025-30156","CVE-2025-50181","CVE-2025-50182","CVE-2025-58754","CVE-2025-59343","CVE-2025-62718","CVE-2025-66030","CVE-2025-66035","CVE-2025-66412","CVE-2025-69873","CVE-2026-0540","CVE-2026-21441","CVE-2026-22610","CVE-2026-25639","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-27970","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33672","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39865","CVE-2026-40175","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-42033","CVE-2026-42034","CVE-2026-42035","CVE-2026-42036","CVE-2026-42037","CVE-2026-42038","CVE-2026-42039","CVE-2026-42040","CVE-2026-42041","CVE-2026-42042","CVE-2026-42043","CVE-2026-42044","CVE-2026-50152","CVE-2026-58224"]},{"id":"WID-SEC-W-2025-2465","title":"IBM InfoSphere Information Server (Axios): Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-58754"]},{"id":"RHSA-2025:18252","title":"Red Hat Security Advisory: Kiali 2.11.4 for Red Hat OpenShift Service Mesh 3.1","vulnerabilityIds":["CVE-2025-58754"]},{"id":"ICSA-26-071-03","title":"Siemens SIDIS Prime","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62522","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610"]},{"id":"RHSA-2025:23546","title":"Red Hat Security Advisory: Red Hat Quay 3.16.0","vulnerabilityIds":["CVE-2024-34156","CVE-2025-47913","CVE-2025-58183","CVE-2025-58754"]},{"id":"RHSA-2025:22684","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update","vulnerabilityIds":["CVE-2022-21698","CVE-2024-24786","CVE-2025-7195","CVE-2025-27144","CVE-2025-47907","CVE-2025-53547","CVE-2025-58754"]},{"id":"RHSA-2026:0718","title":"Red Hat Security Advisory: Moderate: Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update","vulnerabilityIds":["CVE-2025-7195","CVE-2025-9288","CVE-2025-47907","CVE-2025-58183","CVE-2025-58754"]},{"id":"RHSA-2025:22759","title":"Red Hat Security Advisory: RHOAI 2.22.3 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-9905","CVE-2025-12060","CVE-2025-47907","CVE-2025-53643","CVE-2025-58183","CVE-2025-58754","CVE-2025-62156","CVE-2025-62727"]},{"id":"NCSC-2026-0127","title":"Kwetsbaarheden verholpen in Oracle PeopleSoft","vulnerabilityIds":["CVE-2026-22019","CVE-2026-34266","CVE-2026-34269","CVE-2026-34277","CVE-2026-34280","CVE-2026-34295","CVE-2026-34299","CVE-2026-34300","CVE-2026-34301","CVE-2026-34306","CVE-2026-34307","CVE-2026-34309","CVE-2026-35241","CVE-2025-8194","CVE-2025-14017","CVE-2025-15467","CVE-2025-43967","CVE-2025-58754","CVE-2025-66418","CVE-2025-68161","CVE-2026-22006"]},{"id":"RHSA-2025:19961","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update","vulnerabilityIds":["CVE-2025-7195","CVE-2025-47907","CVE-2025-53547","CVE-2025-58754"]},{"id":"NCSC-2026-0079","title":"Kwetsbaarheden verholpen in Siemens producten","vulnerabilityIds":["CVE-2024-29857","CVE-2024-30171","CVE-2024-30172","CVE-2024-41996","CVE-2025-6965","CVE-2025-7783","CVE-2025-9230","CVE-2025-9232","CVE-2025-9670","CVE-2025-12816","CVE-2025-15284","CVE-2025-27769","CVE-2025-40943","CVE-2025-55018","CVE-2025-58751","CVE-2025-58752","CVE-2025-58754","CVE-2025-62439","CVE-2025-62522","CVE-2025-64157","CVE-2025-64718","CVE-2025-64756","CVE-2025-66030","CVE-2025-66031","CVE-2025-66035","CVE-2025-66412","CVE-2025-69277","CVE-2026-22610","CVE-2026-24858","CVE-2026-25569","CVE-2026-25570","CVE-2026-25571","CVE-2026-25572","CVE-2026-25573","CVE-2026-25605"]},{"id":"RHSA-2025:19529","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.7.2 release.","vulnerabilityIds":["CVE-2025-58754","CVE-2025-59343"]},{"id":"RHSA-2025:19335","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.14.1 security update","vulnerabilityIds":["CVE-2025-7195","CVE-2025-7783","CVE-2025-9287","CVE-2025-9288","CVE-2025-47907","CVE-2025-53547","CVE-2025-58754"]},{"id":"RHSA-2026:1018","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.4 security update","vulnerabilityIds":["CVE-2025-47913","CVE-2025-55190","CVE-2025-58183","CVE-2025-58754","CVE-2025-61729","CVE-2025-68156"]},{"id":"RHSA-2026:0627","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update","vulnerabilityIds":["CVE-2025-7195","CVE-2025-9287","CVE-2025-9288","CVE-2025-27144","CVE-2025-47907","CVE-2025-58183","CVE-2025-58754"]},{"id":"RHSA-2025:19221","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-9907","CVE-2025-9908","CVE-2025-58754","CVE-2025-59343","CVE-2025-59682"]},{"id":"RHSA-2025:23069","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2025-9907","CVE-2025-9908","CVE-2025-9909","CVE-2025-58754","CVE-2025-59530","CVE-2025-64459"]},{"id":"RHSA-2025:16747","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.6.5 release.","vulnerabilityIds":["CVE-2025-58754"]},{"id":"RHSA-2025:19375","title":"Red Hat Security Advisory: RHACS 4.8.5 security and bug fix update","vulnerabilityIds":["CVE-2025-58754"]},{"id":"RHSA-2025:23131","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update","vulnerabilityIds":["CVE-2025-9907","CVE-2025-9908","CVE-2025-9909","CVE-2025-58754","CVE-2025-59530","CVE-2025-62707","CVE-2025-62727","CVE-2025-64459"]},{"id":"msrc_CVE-2025-58754","title":"Axios is vulnerable to DoS attack through lack of data size check","vulnerabilityIds":["CVE-2025-58754"]},{"id":"WID-SEC-W-2025-2134","title":"Red Hat Enterprise Linux (Developer Hub): Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-58754"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-28992","identifiers":["EUVD-2025-28992","CVE-2025-58754","GHSA-4hjh-wcwx-xvwj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}