Axios fetch adapter ReadableStream uploads bypass maxBodyLength

Severity: high · CVSS 7.5 · Published 2026-08-01

Axios is a widely-used HTTP client library. The fetch adapter (used in browsers, edge runtimes, and Node.js environments) fails to enforce upload size limits when handling streamed request bodies whose size cannot be determined in advance. An attacker can supply unknown-length stream data to bypass the configured maxBodyLength limit, causing excessive outbound network traffic, resource exhaustion, and potential quota/bandwidth depletion on upstream APIs.

Technologies: Axios. Vendors: Axios.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 1 August 2026.
Which products and versions are affected?
Axios >=1.7.0, <1.18.0.
Is there a fix for This vulnerability?
A patch was published on 2026-08-01: Patched in axios 1.18.0 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in lib/adapters/fetch.js where the getBodyLength() function lacks handling for ReadableStream objects. When resolveBodyLength() is called on a live ReadableStream without a finite Content-Length header, it returns undefined. The pre-dispatch maxBodyLength check then short-circuits because it only throws when the resolved length is a finite number exceeding the limit. The in-flight stream wrapper (trackStream()) only emits progress events and does not enforce any byte cap. This allows the entire stream to be transmitted to fetch() unbounded, bypassing the size restriction. The HTTP adapter's stream enforcement path is not affected as it properly counts chunks and rejects oversized uploads. Exploitation requires an application to pass attacker-controlled, unknown-length stream data to axios while relying on maxBodyLength as a size guard. The vulnerability affects axios 1.7.0 before 1.18.0 when using the fetch adapter explicitly or in environments where fetch is the default.

Affected products

  • npm axios >=1.7.0, <1.18.0

Timeline

  • 2026-07-06: disclosed: GHSA-jqh4-m9w3-8hp9 published by axios maintainers
  • 2026-08-01: disclosed: Duplicate advisory GHSA-39j5-w47m-2gmv published; CVE-2026-67317 assigned
  • 2026-08-01: patched: Patched in axios 1.18.0 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.