Backport maxContentLength vulnerability fix to v0.x

[FeBe95]

Backports fix for GHSA-4hjh-wcwx-xvwj on v1.x (#7011) to v0.x.

[mayonfrancis]

Thanks @FeBe95 for the fix! Will there be a release in npm for this?

[rai-gondim-vindi]

@jasonsaayman Is there any forecast for the new release tag 0.30.2?

[tstackhouse]

Looks like the latest CI build on the 0.x branch failed after this was merged: https://github.com/axios/axios/actions/runs/17768941147

[FeBe95]

@tstackhouse Yes, this CI run failed, but only due to some code style rule violations. This shouldn't prevent the maintainers from releasing a new 0.x version.

[jasonsaayman]

i will try get to the release today, sorry its quite a manual process which i will try improve

[FeBe95]

Version 0.30.2 has been released just now:

• https://github.com/axios/axios/releases/tag/v0.30.2
• https://www.npmjs.com/package/axios/v/0.30.2

[FeBe95]

Update: The GitHub Advisory Database was updated to reflect the affected versions. It now lists 0.30.2 as patched.

• Advisory: GHSA-4hjh-wcwx-xvwj
• Pull request: [GHSA-4hjh-wcwx-xvwj] Axios is vulnerable to DoS attack through lack of data size check github/advisory-database#6221

---

Note

Unfortunately, the npm registry hasn't caught up yet, so npm audit still lists 0.30.2 as vulnerable.

curl -s  https://registry.npmjs.org/-/npm/v1/security/advisories/bulk --json '{"axios": ["0.30.2"]}'

{
    "axios": [
        {
            "id": 1107599,
            "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
            "title": "Axios is vulnerable to DoS attack through lack of data size check",
            "severity": "high",
            "vulnerable_versions": "<1.12.0",
            "cwe": [
                "CWE-770"
            ],
            "cvss": {
                "score": 7.5,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            }
        }
    ]
}

[FeBe95]

One final update on this: The NPM registry has been updated. If you have version 0.30.2 installed, the npm audit command will no longer show Axios as vulnerable.