Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.

redhat RHSA-2026:34160: RHSA-2026:34160: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did     not enforce configured request and response size limits when requests were sent with the fetch adapter.
    Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch     adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits     being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or     compromised server returns an oversized response, when an attacker can supply a large data: URL, or when     an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as     a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0. (CVE-2026-44488)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did
    not enforce configured request and response size limits when requests were sent with the fetch adapter.
    Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch
    adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits
    being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or
    compromised server returns an oversized response, when an attacker can supply a large data: URL, or when
    an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as
    a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0. (CVE-2026-44488)

ID	Name	Product	Family	Severity
320687	Linux Distros Unpatched Vulnerability : CVE-2026-44488	Nessus	Misc.	high
442643	SCA: security update for axios (GHSA-777c-7fjr-54vf)	Tenable Cloud Security	SCA Checks	high
442643	SCA: security update for axios (GHSA-777c-7fjr-54vf)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-44488

high

Tenable Plugins

Coming Soon

high

high

high