Axios maxBodyLength bypass in HTTP/2 streamed uploads

Executive brief

Axios, a popular library for making web requests, contains a flaw where it fails to limit the size of data being uploaded when using the HTTP/2 protocol in Node.js environments. This allows an attacker to send much more data than the application is configured to allow, potentially leading to increased cloud costs, exhaustion of data quotas, or service slowdowns. The issue specifically affects applications that proxy user-provided data streams to other services using HTTP/2.

Technical details

A vulnerability in the Axios Node.js HTTP adapter allows streamed request bodies to bypass the 'maxBodyLength' configuration when using HTTP/2. The root cause is that while Axios correctly identifies the HTTP/2 transport, the internal byte-counting stream wrapper is incorrectly gated behind a condition that requires 'maxRedirects' to be zero, which is not the default. Consequently, when 'httpVersion: 2' is specified, the native Node.js HTTP/2 request API is used without the protective wrapper, allowing unbounded data transmission. Attackers can exploit this to cause resource exhaustion or bypass egress policy limits. The issue is resolved in version 1.18.0; a workaround for versions >= 1.15.1 is to explicitly set 'maxRedirects: 0'.

Affected products

• axios axios >= 1.13.0, < 1.18.0

Timeline

• 2026-07-06: advisory: GitHub Advisory published
• 2026-07-20: disclosed: Vulnerability disclosed

References

• https://api.github.com/users/asadeddin
• https://github.com/asadeddin
• https://api.github.com/users/asadeddin/gists%7B/gist_id%7D
• https://api.github.com/users/asadeddin/repos
• https://avatars.githubusercontent.com/u/1538486?v=4
• https://api.github.com/users/asadeddin/events%7B/privacy%7D