# CVE-2026-67318: Axios HTTP/2 streamed uploads bypass maxBodyLength

Source: https://junglewise.ai/threats/cve-2026-67318-axios-http-2-streamed-uploads-bypass-maxbodylength  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67318 · Severity: medium · CVSS 5.3 · Published 2026-08-01

Axios is a popular HTTP client library used in Node.js applications. When uploading data using HTTP/2 with a configured upload size limit (`maxBodyLength`), the library fails to enforce that limit on streamed uploads, allowing attackers who control the upload stream to transmit data far exceeding the configured limit. This can lead to excess bandwidth consumption, increased costs, and denial-of-service on the application or upstream services.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios).

## Quick answers

**Is CVE-2026-67318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67318 being exploited in the wild.

**How severe is CVE-2026-67318?** Medium severity, with a CVSS score of 5.3, published 1 August 2026.

**Which products and versions are affected?** Axios >=1.13.0, <1.18.0.

**Is there a fix for CVE-2026-67318?** A patch was published on 2026-01-01: Patched in axios >=1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67318 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67318?** Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a validation bypass in axios's HTTP/2 adapter (lib/adapters/http.js). When httpVersion is set to 2 and the request body is supplied as a stream, axios selects the HTTP/2 transport unconditionally and does not apply the stream-level byte-counting wrapper that enforces maxBodyLength. The wrapper is only activated for HTTP/1.1 requests with maxRedirects: 0, leaving HTTP/2 streamed uploads unprotected. An attacker who can control or influence the stream passed to axios can cause the application to transmit significantly more data than the configured limit (proof-of-concept demonstrates transmitting 2 MB with a 1 KB limit). Buffered request bodies (strings, buffers, arrays) remain checked before transport selection. The vulnerability requires Node.js HTTP adapter usage, httpVersion: 2, stream-based request data, and a finite maxBodyLength. Patches are available in axios >= 1.18.0.

## Affected products

- axios axios >=1.13.0, <1.18.0

## Identifiers

- CVE-2026-67318
- GHSA-mwf2-3pr3-8698

## Timeline

- 2026-07-20: disclosed
- 2026-01-01: patched: Patched in axios >=1.18.0
- 2026-07-06: other: Advisory published on GitHub

## References

- [https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698](https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)