Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

🗓️ 20 Jul 2026 22:27:12Reported by GitHub Advisory DatabaseType

Fetch adapter ignores maxBodyLength for ReadableStream uploads, enabling oversized untrusted streams.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been found in IBM Security Verify Information Queue	6 Aug 202607:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities	6 Aug 202622:32	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in axios	2 Sep 202619:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office	28 Aug 202616:36	–	ibm
ATTACKERKB	CVE-2026-67317	1 Aug 202612:22	–	attackerkb
BDU FSTEC	The vulnerability of the fetch library for axios allows attackers to compromise the accessibility of protected information.	3 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-67317 vulnerabilities	2 Sep 202620:26	–	cgr
CVE	CVE-2026-67317	1 Aug 202612:22	–	cve
Cvelist	CVE-2026-67317 axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream	1 Aug 202612:22	–	cvelist
Debian CVE	CVE-2026-67317	1 Aug 202612:22	–	debiancve

Vulners

Node

axios axiosRange1.7.0–1.18.0npm

Source	Link
github	www.github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9
github	www.github.com/axios/axios/pull/11000
github	www.github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2
github	www.github.com/axios/axios/releases/tag/v1.18.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-67317
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-68947
vulncheck	www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream
github	www.github.com/advisories/GHSA-jqh4-m9w3-8hp9

01 Sep 2026 18:38Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.5

CVSS 46.3

EPSS0.005

SSVC