ROOT-APP-NPM-CVE-2026-67317 CVE-2026-67317 in axios - Patched by Root

Root has patched CVE-2026-67317 in the axios package for Root:npm. Multiple fixed versions available...

CVE-2026-67317 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, awx, langfuse, opensearch-dashboards, prism, jitsucom-jitsu, langfuse-fips, lerna, semaphore, kubeflow-centraldashboard, librechat, wazuh-dashboard, kibana, wazuh-dashboard-fips, gitlab-rails-ce, redisinsight, nextcloud-server,...

CVE-2026-67317 vulnerabilities

Vulnerabilities for packages: nextcloud-server, opensearch-dashboards, jitsucom-jitsu, kubeflow-centraldashboard, langfuse, lerna, prism...

CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +12460 more potentially affected by CVE-2026-67317 via axios (>=1.7.0, <=1.17.0)

axios NPM version =1.7.0, =0.0.8, =1.0.54, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.1.40, =1.1.65 and more Source cves: CVE-2026-67317 Source advisory: SNYK:JS-AXIOS-18065353...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +12460 more potentially affected by CVE-2026-67317 via axios (>=1.7.0, <=1.17.0)

axios NPM version =1.7.0, =0.0.8, =1.0.54, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.1.40, =1.1.65 and more Source cves: CVE-2026-67317 Source advisory: OSV:GHSA-JQH4-M9W3-8HP9...