Security vulnerabilities and automated fixes for cve 2025 58754 issues
2 posts found
A high-severity denial of service vulnerability (CVE-2025-58754) was discovered in axios versions prior to 1.12.0, where the library failed to enforce data size limits on HTTP responses. This flaw could allow attackers to crash Node.js applications by sending massive payloads that exhaust memory. The fix involved upgrading axios from version 1.11.0 to 1.12.0 in the ComfyUIGen plugin's dependencies.
CVE-2025-58754 is a high-severity Denial of Service vulnerability in axios versions prior to 1.12.0, caused by a lack of data size validation on incoming responses. An attacker could send or trigger excessively large HTTP responses that exhaust the application's memory, crashing the Node.js process. The fix upgrades axios from 1.9.0 to 1.12.0, which introduces proper data size checks.