Listen to this Post
The CVE-2025-58754 vulnerability in solspace/craft-freeform arises from its use of a vulnerable Axios version (^1.7.7) in the Freeform plugin v4.1.29 for Craft CMS. When Axios runs on Node.js and processes a URL with the “data:” scheme, it bypasses normal HTTP handling. Instead, the Node.js HTTP adapter decodes the entire data URI payload directly into memory as a Buffer or Blob, generating a synthetic 200 response. This path ignores the configured “maxContentLength” and “maxBodyLength” limits, which only apply to HTTP responses. Consequently, an unauthenticated attacker can craft a malicious “data:” URI containing an extremely large payload. When Axios attempts to decode this URI, it allocates unbounded memory to hold the entire data, leading to memory exhaustion. This causes the Node.js process to crash, resulting in a Denial of Service (DoS). The attack is effective even if the Axios request specifies “responseType: ‘stream'”, as the memory allocation occurs before stream handling.
Platform: Craft Freeform Plugin
Version: 4.1.29
Vulnerability: DoS via memory exhaustion
Severity: low
date: Jan 15 2026
Prediction: Patch expected soon
What Undercode Say:
Analytics
Check Axios version in project
npm list axios
Simulate vulnerable request with large data URI using curl
curl -X POST "http://target.com/api" -d 'url=data:text/plain;base64,'$(dd if=/dev/zero bs=1M count=100 | base64)
Node.js code snippet to test vulnerability
const axios = require('axios');
axios.get('data:text/plain;base64,' + 'A'.repeat(1000000000))
.catch(err => console.log('Potential crash'));
how Exploit:
Send crafted HTTP request with large data URI to endpoint using Axios, triggering memory exhaustion and process crash.
Protection from this CVE
Upgrade Axios version, implement input validation, use rate limiting.
Impact:
Service downtime, resource exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
