CVE-2026-67317 axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream

🗓️ 01 Aug 2026 12:22:16Reported by VulnCheckType

Axios stream max body length bypass in fetch adapter when length is unknown, risking resource exhaustion.

Reporter	Title	Published	Views	Family All 232
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been found in IBM Security Verify Information Queue	6 Aug 202607:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-67312, CVE-2026-67313, CVE-2026-67316, CVE-2026-67317, CVE-2026-67319)	25 Sep 202611:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities	6 Aug 202622:32	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in axios	2 Sep 202619:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in axios	16 Sep 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in axios bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.	2 Oct 202616:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office	28 Aug 202616:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses multiple dependencies which are vulnerable to multiple High Severity CVEs.	29 Sep 202614:53	–	ibm
attackerkb	CVE-2026-67317	1 Aug 202612:22	–	attackerkb
BDU FSTEC	The vulnerability of the fetch library for axios allows attackers to compromise the accessibility of protected information.	3 Aug 202600:00	–	bdu_fstec

[
  {
    "vendor": "axios",
    "product": "axios",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:npm/axios",
    "versions": [
      {
        "version": "1.7.0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "1.18.0"
      },
      {
        "version": "1.18.0",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9
vulncheck	www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream

01 Aug 2026 12:22Current

CVSS 46.3

EPSS0.00602

SSVC

CWE-770