Executive brief
Axios is a widely-used HTTP client library. The fetch adapter (used in browsers, edge runtimes, and Node.js environments) fails to enforce upload size limits when handling streamed request bodies whose size cannot be determined in advance. An attacker can supply unknown-length stream data to bypass the configured maxBodyLength limit, causing excessive outbound network traffic, resource exhaustion, and potential quota/bandwidth depletion on upstream APIs.
Technical details
The vulnerability exists in lib/adapters/fetch.js where the getBodyLength() function lacks handling for ReadableStream objects. When resolveBodyLength() is called on a live ReadableStream without a finite Content-Length header, it returns undefined. The pre-dispatch maxBodyLength check then short-circuits because it only throws when the resolved length is a finite number exceeding the limit. The in-flight stream wrapper (trackStream()) only emits progress events and does not enforce any byte cap. This allows the entire stream to be transmitted to fetch() unbounded, bypassing the size restriction. The HTTP adapter's stream enforcement path is not affected as it properly counts chunks and rejects oversized uploads. Exploitation requires an application to pass attacker-controlled, unknown-length stream data to axios while relying on maxBodyLength as a size guard. The vulnerability affects axios 1.7.0 before 1.18.0 when using the fetch adapter explicitly or in environments where fetch is the default.
Affected products
- npm axios >=1.7.0, <1.18.0
Timeline
- 2026-07-06: disclosed: GHSA-jqh4-m9w3-8hp9 published by axios maintainers
- 2026-08-01: disclosed: Duplicate advisory GHSA-39j5-w47m-2gmv published; CVE-2026-67317 assigned
- 2026-08-01: patched: Patched in axios 1.18.0 or later