Axios allows HTTP responses sent as streams to bypass the configured maximum content length. This means that, when responseType: 'stream' is used, the client can receive data of arbitrary size without any limits, potentially exhausting memory or disk resources. The weakness conforms to CWE-770, Resource Exhaustion, and can cause a denial of service if the stream grows large enough.

Versions of axios prior to 1.15.1 (for npm) and 0.31.1 (for older releases) are affected. The vulnerability applies to both Node.js and browser environments that use axios to request data via streams.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% implies a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the issue by sending a very large streamed response to an application that processes it with axios. The likely attack vector is a remote HTTP endpoint from which a client requests a large stream, potentially exhausting system resources and causing a service outage.