Axios did not enforce configured request or response size limits when the fetch adapter was used, allowing attacker-controlled payloads to exceed the configured maxContentLength or maxBodyLength thresholds. This can cause a server to consume excessive memory or network resources, leading to a denial of service. The weakness corresponds to CWE-770, "Unchecked Input Size for Resource Allocation."

JavaScript applications that use the axios library, specifically versions 1.7.0 through 1.15.x, are affected when the fetch adapter is active. This includes Node.js and browser environments that default to the fetch adapter. The vulnerability is mitigated in axios 0.32.0 and 1.16.0 and later.

The CVSS score of 7.5 indicates a high severity; the EPSS score is not available and the vulnerability is not listed in CISA KEV. An attacker can exploit the flaw by either providing an oversized response from a malicious or compromised server, submitting a large data: URL, or forwarding large request bodies through axios while relying on the misapplied body length limits. The attack is feasible in any scenario where user input is forwarded with axios and the fetch adapter is present, making it a significant risk to applications that cannot immediately update the library.