CVE-2026-42036 - Vulnerability Analysis
MediumCVSS: 5.3Last Updated: April 27, 2026
Axios - Denial of Service
Published: April 24, 2026Updated: April 27, 2026PoC AvailableRemote Exploitable
Overview
Axios < 1.15.1 and < 0.31.1 contains a denial of service caused by lack of maxContentLength enforcement when responseType is 'stream', letting attackers bypass response-size limits, exploit requires crafted response.
Severity & Score
Severity: Medium
CVSS Score: 5.3
Impact
Attackers can bypass response size limits causing unbounded resource consumption leading to denial of service.
Mitigation
Upgrade to version 1.15.1 or 0.31.1 or later.
Related Resources
Details
- CVE ID
- CVE-2026-42036
- Severity
- Medium
- CVSS Score
- 5.3
- Type
- misconfiguration
- Status
- confirmed
CWE
- CWE-770
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L