Node.js Module axios 1.7.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67317)

The version of the axios Node.js module installed on the remote host is 1.7.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers ca...

axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests

A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...

axios Uncontrolled Resource Consumption

The vulnerability of the axios library is related to an uncontrolled resource consumption when processing the maxBodyLength parameter. Exploiting this vulnerability could allow a remote attacker to compromise the accessibility of the protected information...

CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...

NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...

GHSA-JQH4-M9W3-8HP9 Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

Summary axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it...

UBUNTU-CVE-2026-44488

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolve...

CVE-2026-44488

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolve...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the fetch adapter when finite size limits are configured but not enforced. An attacker can exhaust server resource...

GHSA-5C9X-8GCM-MPGX Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 native http/https transport path. Oversized streamed uploads are sent fully even when the caller sets strict body limits. Details Relevant flow in lib/adapters/http.js: - 556-564: maxBodyLength check applie...

EUVD-2026-25601

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0...

Stream Request Bypass

Axios is vulnerable to Stream Request Bypass. The vulnerability is due to the bypassing of maxBodyLength when maxRedirects is set to 0 for stream request bodies, where oversized streamed uploads are sent fully even when the caller sets strict body limits...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the data.pipereq upload path in the HTTP adapter. An attacker can send a streamed request body larger than the...