Axios maxBodyLength bypass in fetch adapter ReadableStream uploads

Executive brief

Axios is a popular library used by web applications to send network requests. A vulnerability in its 'fetch' adapter allows attackers to bypass configured upload size limits when sending data as a stream. This can lead to unexpected network costs, exhaustion of API quotas, or service instability due to excessive resource consumption.

Technical details

The vulnerability exists in the Axios fetch adapter (lib/adapters/fetch.js) where the getBodyLength() function lacks a branch to handle WHATWG ReadableStream objects. Consequently, resolveBodyLength() returns undefined for these streams, causing the pre-dispatch maxBodyLength check to be skipped. Furthermore, the trackStream() wrapper used for progress monitoring does not implement byte-counting enforcement to abort the request if the limit is exceeded during transmission. This allows an attacker to transmit payloads of arbitrary size regardless of the maxBodyLength configuration. The issue is specific to the fetch adapter and does not affect the Node.js HTTP adapter. A fix is available in version 1.18.0.

Affected products

• Axios Axios >= 1.7.0, < 1.18.0

Timeline

• 2026-07-06: disclosed: Initial disclosure on GitHub
• 2026-07-20: advisory: Updated advisory published
• 2026-07-20: patched: Fixed in version 1.18.0

References

• https://api.github.com/users/asadeddin
• https://github.com/asadeddin
• https://api.github.com/users/asadeddin/gists%7B/gist_id%7D
• https://api.github.com/users/asadeddin/repos
• https://avatars.githubusercontent.com/u/1538486?v=4
• https://api.github.com/users/asadeddin/events%7B/privacy%7D