Executive brief
Axios is a popular HTTP client library used in Node.js applications. When uploading data using HTTP/2 with a configured upload size limit (`maxBodyLength`), the library fails to enforce that limit on streamed uploads, allowing attackers who control the upload stream to transmit data far exceeding the configured limit. This can lead to excess bandwidth consumption, increased costs, and denial-of-service on the application or upstream services.
Technical details
The vulnerability is a validation bypass in axios's HTTP/2 adapter (lib/adapters/http.js). When httpVersion is set to 2 and the request body is supplied as a stream, axios selects the HTTP/2 transport unconditionally and does not apply the stream-level byte-counting wrapper that enforces maxBodyLength. The wrapper is only activated for HTTP/1.1 requests with maxRedirects: 0, leaving HTTP/2 streamed uploads unprotected. An attacker who can control or influence the stream passed to axios can cause the application to transmit significantly more data than the configured limit (proof-of-concept demonstrates transmitting 2 MB with a 1 KB limit). Buffered request bodies (strings, buffers, arrays) remain checked before transport selection. The vulnerability requires Node.js HTTP adapter usage, httpVersion: 2, stream-based request data, and a finite maxBodyLength. Patches are available in axios >= 1.18.0.
Affected products
- axios axios >=1.13.0, <1.18.0
Timeline
- 2026-07-20: disclosed
- 2026-01-01: patched: Patched in axios >=1.18.0
- 2026-07-06: other: Advisory published on GitHub