solspace/craft-freeform Has a DoS Vulnerability
Summary
Freeform plugin v4.1.29 uses vulnerable Axios ^1.7.7 allowing unauthenticated attackers to crash servers via malicious data: URIs causing memory exhaustion (CVE-2025-58754).
Freeform version: 4.1.29 Craft CMS version: 4.16.8
Impact
When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response. This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.
https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj https://github.com/axios/axios/pull/7011 https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593 https://github.com/axios/axios/releases/tag/v1.12.0
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | solspace/craft-freeform | < 4.1.30 | 4.1.30 |
References
- https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
- https://github.com/solspace/craft-freeform/security/advisories/GHSA-58q2-9x27-h2jm
- https://github.com/axios/axios/pull/7011
- https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
- https://github.com/solspace/craft-freeform/commit/e7402a1d1ce9f28ecb6ce659885ac66391d3a040
- https://github.com/axios/axios/releases/tag/v1.12.0
- https://github.com/solspace/craft-freeform
- https://github.com/solspace/craft-freeform/releases/tag/v4.1.30
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-770- Platform
- Composer
- Package
solspace/craft-freeform- Disclosed
- 15.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-58q2-9x27-h2jm - CC BY 4.0
Vulnerability history: solspace/craft-freeform
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 08.2025 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Medium 1
- Low 4
Disclosures per year
- 2025: 1
- 2026: 5
-
solspace/craft-freeform Has a DoS Vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.