Vulnerabilities

 1 via 1 paths

Dependencies

 37

Source

 GitHub

Commit

 e563c8db

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: axios
  • Introduced through: axios@0.30.1

Detailed paths

  • Introduced through: extract-serac@c2corg/extract-serac#e563c8db24d77c80a2331e19a0665c3c7960e4d8 › axios@0.30.1
    Remediation: Upgrade to axios@1.12.0.

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with an excessive payload, causing allocation of memory for content decoding before verifying content size limits.

Remediation

Upgrade axios to version 1.12.0 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report