Backport maxContentLength vulnerability fix to v0.x - #7034

Thanks @FeBe95 for the fix! Will there be a release in npm for this?

@jasonsaayman Is there any forecast for the new release tag 0.30.2?

Looks like the latest CI build on the 0.x branch failed after this was merged: https://github.com/axios/axios/actions/runs/17768941147

@tstackhouse Yes, this CI run failed, but only due to some code style rule violations. This shouldn't prevent the maintainers from releasing a new 0.x version.

i will try get to the release today, sorry its quite a manual process which i will try improve

Version 0.30.2 has been released just now:

• https://github.com/axios/axios/releases/tag/v0.30.2
• https://www.npmjs.com/package/axios/v/0.30.2

Update: The GitHub Advisory Database was updated to reflect the affected versions. It now lists 0.30.2 as patched.

• Advisory: GHSA-4hjh-wcwx-xvwj
• Pull request: [GHSA-4hjh-wcwx-xvwj] Axios is vulnerable to DoS attack through lack of data size check github/advisory-database#6221

curl -s  https://registry.npmjs.org/-/npm/v1/security/advisories/bulk --json '{"axios": ["0.30.2"]}'

{
    "axios": [
        {
            "id": 1107599,
            "url": "https://github.com/advisories/GHSA-4hjh-wcwx-xvwj",
            "title": "Axios is vulnerable to DoS attack through lack of data size check",
            "severity": "high",
            "vulnerable_versions": "<1.12.0",
            "cwe": [
                "CWE-770"
            ],
            "cvss": {
                "score": 7.5,
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            }
        }
    ]
}

One final update on this: The NPM registry has been updated. If you have version 0.30.2 installed, the npm audit command will no longer show Axios as vulnerable.