CVE-2026-42036: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42036 is a Denial of Service vulnerability in the Axios HTTP client library for Node.js, where HTTP adapter streamed responses bypass the configured maxContentLength limit. When responseType: 'stream' is used, Axios returns the response stream without enforcing the size restriction, allowing unbounded downstream consumption of response data. It affects Axios versions up to and including 0.31.0 and versions 1.0.0 through 1.15.0. The vulnerability was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In lib/adapters/http.js, when responseType === 'stream', Axios immediately resolves the promise with the raw stream (lines 786–789), bypassing the maxContentLength enforcement logic that only exists in the non-stream buffering branch (lines 797–810). As a result, callers that configure maxContentLength as a safety boundary receive no protection when using the stream adapter — an attacker controlling or influencing the HTTP server can serve arbitrarily large responses that the application will consume without limit. No authentication or special privileges are required to trigger this condition (GitHub Advisory).

Successful exploitation can cause denial of service through unbounded memory or bandwidth consumption in Node.js applications that use Axios with responseType: 'stream' and rely on maxContentLength as a resource guard. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Applications in high-throughput environments or those fetching data from untrusted or attacker-controlled endpoints are most at risk of resource exhaustion leading to service degradation or crash. Multiple IBM enterprise products incorporating vulnerable Axios versions are also affected, broadening the potential impact surface (Github Advisory, IBM Advisory).

A proof-of-concept is publicly documented in the official GitHub Security Advisory, providing concrete reproduction steps (start an HTTP server returning 2 MiB, call Axios with responseType: 'stream' and maxContentLength: 1024, read the stream fully — the full 2 MiB is received without error). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.031% (9th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Identify a vulnerable target: Locate a Node.js application using Axios versions ≤0.31.0 or 1.0.0–1.15.0 that makes HTTP requests with responseType: 'stream' and relies on maxContentLength for resource limiting.
2. Control or influence the HTTP endpoint: Set up or compromise an HTTP server that the target application fetches data from, configured to return an arbitrarily large response body (e.g., 2 MiB or more).
3. Trigger the vulnerable code path: Cause the target application to make an Axios request to the large-response endpoint using adapter: 'http', responseType: 'stream', and a maxContentLength value (e.g., 1024 bytes).
4. Observe bypass: The application reads the full stream without any size-limit rejection, consuming unbounded memory or bandwidth — unlike responseType: 'text' which would correctly reject with a maxContentLength exceeded error.
5. Achieve DoS: Repeat or sustain large responses to exhaust the target application's memory or bandwidth, causing degraded performance or a crash (GitHub Advisory).

• Network: Unusually large HTTP responses being received by Node.js application servers from external or internal endpoints; sustained high-bandwidth inbound traffic to services using Axios.
• Process: Node.js process memory usage growing unboundedly during HTTP streaming operations; application crashes or OOM (out-of-memory) errors in services using Axios with responseType: 'stream'.
• Logs: Application logs showing no maxContentLength size exceeded errors despite large response bodies being received; absence of expected size-limit rejections in Axios-based request handlers.
• File System: Heap dump files or core dumps generated by Node.js processes due to memory exhaustion during stream processing (GitHub Advisory).

Upgrade Axios to version 1.15.1 (for the 1.x branch) or 0.31.1 (for the 0.x branch), which enforce maxContentLength for streamed responses. As a temporary workaround where upgrading is not immediately possible, implement application-level stream size enforcement by manually tracking bytes read and aborting the stream if the limit is exceeded. IBM has released security patches for all affected products including App Connect Enterprise, Cloud Pak for Integration, Voice Gateway, Maximo Application Suite, watsonx Code Assistant, Quantum Safe Explorer, Business Automation Manager Open Editions, License Metric Tool, Edge Application Manager, Aspera Enterprise WebApps, and InfoSphere Optim Archive Viewer — consult the respective IBM security bulletins for specific fix versions (GitHub Advisory, IBM Advisory).

The vulnerability was reported by security researcher asadeddin and published by Axios maintainer jasonsaayman via the GitHub Security Advisory program on April 24, 2026. IBM issued over a dozen security bulletins across its product portfolio acknowledging the impact of this and related Axios CVEs, reflecting the broad adoption of Axios in enterprise software. No significant independent researcher commentary or notable social media discussion has been identified beyond the advisory itself (GitHub Advisory, IBM Advisory).