# Node.js Package: axios \< 1.12.0 - Remote Denial of Service Vulnerability

**URL:** <https://discourse.nodered.org/t/node-js-package-axios-1-12-0-remote-denial-of-service-vulnerability/99107>\
**Category:** Core Development\
**Tags:** security\
**Created:** [19 September 2025 06:09 UTC](https://discourse.nodered.org/t/node-js-package-axios-1-12-0-remote-denial-of-service-vulnerability/99107 "2025-09-19T06:09:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![GowriAradhya](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gowriaradhya/32/25062_2.png) [@GowriAradhya](https://discourse.nodered.org/u/GowriAradhya)\
**Post date:** [19 September 2025 06:09 UTC](https://discourse.nodered.org/t/node-js-package-axios-1-12-0-remote-denial-of-service-vulnerability/99107/1 "2025-09-19T06:09:08Z")

</div>

Package name: axios  
Node-RED version:4.1.0

Node-red-admin "version": "4.1.1", depends on axios version 1.11.0, which contains vulnerabilities.

CVE reference link:

> **[NVD - CVE-2025-58754](https://nvd.nist.gov/vuln/detail/CVE-2025-58754)**

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [19 September 2025 08:42 UTC](https://discourse.nodered.org/t/node-js-package-axios-1-12-0-remote-denial-of-service-vulnerability/99107/2 "2025-09-19T08:42:07Z")

</div>

Thanks for reporting. I've moved this to the Core Dev category for better visibility from the core devs.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [19 September 2025 08:44 UTC](https://discourse.nodered.org/t/node-js-package-axios-1-12-0-remote-denial-of-service-vulnerability/99107/3 "2025-09-19T08:44:40Z")

</div>

@GowriAradhya please report security issues via the project’s github security policy rather than on the community forum.

In this instance, the CVE relates to axios’ handling of `data:` uris. It is the `node-red-admin` package that uses axios, and at no time works with `data` uris. So whilst the CVE exists, it is not exposed in any meaningful form.

We will, of course, be doing a maintenance release in the near future and this will get tidied up then - but there’s no immediate issue here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [18 December 2025 08:44 UTC](https://discourse.nodered.org/t/node-js-package-axios-1-12-0-remote-denial-of-service-vulnerability/99107/4 "2025-12-18T08:44:56Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.