The vulnerability allows a bypass of the maxBodyLength restriction for streamed request bodies when maxRedirects is set to 0. An attacker can send arbitrarily large payloads that are fully transmitted despite caller‑defined size limits, potentially exhausting server resources and causing a denial of service.

Axios HTTP client for Node.js and the browser is affected. All releases prior to 1.15.1 and 0.31.1 are vulnerable. The issue is present when the native http/https transport path handles streamed uploads with redirects disabled.

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score of less than 1% shows a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would occur when a client using Axios sends a streamed request with maxRedirects set to 0 to a target that accepts the upload; the request bypasses size limits and can consume bandwidth, memory or storage, leading to service disruption. The attack vector is inferred to be HTTP requests originating from code that uses this configuration.