Executive brief
Axios is a popular HTTP client library used across browsers and Node.js applications. The fetch adapter (used in modern browsers and edge runtimes) fails to enforce upload size limits (maxBodyLength) when handling streaming data from ReadableStream objects. An attacker who can supply or control stream data could bypass configured upload limits, leading to uncontrolled network egress, resource exhaustion, and potential API quota abuse.
Technical details
The vulnerability exists in lib/adapters/fetch.js where the getBodyLength() function lacks a branch to handle ReadableStream objects, causing resolveBodyLength() to return undefined for live streams without a Content-Length header. The pre-dispatch maxBodyLength validation only throws when body length is a finite number exceeding the limit; for streams with unknown length, the check is skipped. The in-flight stream wrapper (trackStream) only emits progress events and does not receive or enforce maxBodyLength constraints. This affects the fetch adapter when used explicitly or selected automatically in edge runtimes and Node.js 18+, but does not affect the HTTP adapter which properly enforces maxBodyLength for streamed uploads. Applications relying on maxBodyLength to control untrusted upload streams are vulnerable to bypass attacks.
Affected products
- Axios axios >=1.7.0, <1.18.0
Timeline
- 2026-07-06: disclosed
- 2026-07-06: patched: Fix available in version 1.18.0
- 2026-08-01: other: Advisory published as GHSA-39j5-w47m-2gmv (duplicate)
- 2026-09-01: other: Advisory withdrawn as duplicate of GHSA-jqh4-m9w3-8hp9