← Vulnerability feed

Vulnerability record · CVE-2019-10742 · published 7 May 2019

CVE-2019-10742: Axios vulnerability

Axios · Axios

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

7.5 CVSS 3.0 High EPSS 6.1% · top 6.8% CWE-755 · CWE-755
7.5CVSS 3.0 base score, v2 5.0
6.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://app.snyk.io/vuln/SNYK-JS-AXIOS-174505 ExploitPatchThird Party Advisory
https://github.com/axios/axios/issues/1098 ExploitThird Party Advisory
https://github.com/axios/axios/pull/1485 PatchThird Party Advisory
https://app.snyk.io/vuln/SNYK-JS-AXIOS-174505 ExploitPatchThird Party Advisory
https://github.com/axios/axios/issues/1098 ExploitThird Party Advisory
https://github.com/axios/axios/pull/1485 PatchThird Party Advisory

Track CVE-2019-10742 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-42043Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axio…EPSS 0.58%9.8CVE-2024-57965Axios origin validation error vulnerabilityIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribu…EPSS 0.38%9.1CVE-2026-42264Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL…EPSS 0.97%9.1CVE-2026-42044Axios mass assignment vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollutio…EPSS 0.86%8.7CVE-2026-44494Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Polluti…EPSS 0.93%8.6CVE-2026-44492Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. Wh…EPSS 0.78%8.3CVE-2026-67320Axios information exposure vulnerabilityaxios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configurat…EPSS 0.52%8.2CVE-2026-44490Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets…EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2019-10742), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.