Summary
Freeform for Craft CMS included a vulnerable version of Axios affected by CVE-2025-58754 / GHSA-4hjh-wcwx-xvwj. The upstream Axios vulnerability can cause excessive memory allocation when Axios is used in a Node.js environment to process attacker-controlled data: URLs.
Freeform 4.1.30 updates the affected dependency.
In typical Craft CMS production environments, Freeform runs server-side in PHP, not Node.js. As a result, the practical impact to Freeform installations depends on whether the vulnerable Axios code is reachable in a Node.js runtime with attacker-controlled input. No direct unauthenticated Craft/PHP server-side exploit path has been confirmed in Freeform.
Details
Package: solspace/craft-freeform
Dependency: Axios
Upstream advisory: CVE-2025-58754 / GHSA-4hjh-wcwx-xvwj
Patched Freeform version: 4.1.30
Axios versions affected by the upstream advisory may allocate excessive memory when handling large data: URIs in Node.js. This behavior can lead to process memory exhaustion and denial of service when attacker-controlled data: URLs are passed to Axios.
Freeform included an affected Axios dependency prior to the dependency update in Freeform 4.1.30.
Impact
The confirmed issue is the presence of an affected Axios dependency. The upstream vulnerability may allow denial of service in applications that use Axios in a Node.js runtime to process attacker-controlled data: URLs.
For Freeform, the practical risk appears limited unless an installation or customization exposes a Node.js execution path where attacker-controlled URLs are passed to Axios. No direct unauthenticated denial-of-service path in Freeform’s Craft/PHP runtime has been confirmed.
Remediation
Update Freeform to 4.1.30 or later.
Workarounds
If updating immediately is not possible, ensure that any custom code using Axios does not pass attacker-controlled data: URLs to Axios in a Node.js runtime. Where URL fetching is required, validate and restrict allowed URL schemes before making requests.
Summary
Freeform for Craft CMS included a vulnerable version of Axios affected by CVE-2025-58754 / GHSA-4hjh-wcwx-xvwj. The upstream Axios vulnerability can cause excessive memory allocation when Axios is used in a Node.js environment to process attacker-controlled
data:URLs.Freeform 4.1.30 updates the affected dependency.
In typical Craft CMS production environments, Freeform runs server-side in PHP, not Node.js. As a result, the practical impact to Freeform installations depends on whether the vulnerable Axios code is reachable in a Node.js runtime with attacker-controlled input. No direct unauthenticated Craft/PHP server-side exploit path has been confirmed in Freeform.
Details
Package:
solspace/craft-freeformDependency: Axios
Upstream advisory: CVE-2025-58754 / GHSA-4hjh-wcwx-xvwj
Patched Freeform version: 4.1.30
Axios versions affected by the upstream advisory may allocate excessive memory when handling large
data:URIs in Node.js. This behavior can lead to process memory exhaustion and denial of service when attacker-controlleddata:URLs are passed to Axios.Freeform included an affected Axios dependency prior to the dependency update in Freeform 4.1.30.
Impact
The confirmed issue is the presence of an affected Axios dependency. The upstream vulnerability may allow denial of service in applications that use Axios in a Node.js runtime to process attacker-controlled
data:URLs.For Freeform, the practical risk appears limited unless an installation or customization exposes a Node.js execution path where attacker-controlled URLs are passed to Axios. No direct unauthenticated denial-of-service path in Freeform’s Craft/PHP runtime has been confirmed.
Remediation
Update Freeform to 4.1.30 or later.
Workarounds
If updating immediately is not possible, ensure that any custom code using Axios does not pass attacker-controlled
data:URLs to Axios in a Node.js runtime. Where URL fetching is required, validate and restrict allowed URL schemes before making requests.