Summary
Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).
Freeform version: 4.1.29
Craft CMS version: 4.16.8
Impact
When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.
GHSA-4hjh-wcwx-xvwj
axios/axios#7011
axios/axios@945435f
https://github.com/axios/axios/releases/tag/v1.12.0
Summary
Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).
Freeform version: 4.1.29
Craft CMS version: 4.16.8
Impact
When Axios runs on Node.js and is given a URL with the
data:scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignoresmaxContentLength/maxBodyLength(which only protect HTTP responses), so an attacker can supply a very largedata:URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requestedresponseType: 'stream'.GHSA-4hjh-wcwx-xvwj
axios/axios#7011
axios/axios@945435f
https://github.com/axios/axios/releases/tag/v1.12.0