CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jqh4-m9w3-8hp9. This link is maintained to preserve external references.

Original Description

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

Summary

axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch" and rely on maxBodyLength to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.

This affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected. The HTTP adapter’s stream upload path is not affected.

Impact

An attacker who can supply or influence a streamed request body can bypass the caller’s configured upload-size limit. Practical impact is unexpected outbound network egress, request-level resource consumption, and possible exhaustion of upstream API quotas or bandwidth.

This does not expose response data, execute code, or modify axios configuration. Exploitability depends on an application passing attacker-controlled, unknown-length stream data to axios and relying on maxBodyLength as the size guard.

Affected Functionality

Affected:

• adapter: "fetch" or environments where axios selects the fetch adapter.
• Request methods with bodies, such as POST, PUT, and PATCH.
• data as a WHATWG ReadableStream without a reliable Content-Length.
• Configurations that set maxBodyLength to a finite value.

Not affected:

• Axios versions before the fetch adapter was introduced.
• The Node HTTP adapter stream enforcement path.
• Known-length fetch-adapter bodies in 1.16.0+, such as strings, Blob, ArrayBuffer, ArrayBufferView, URLSearchParams, spec-compliant FormData, or requests with a finite Content-Length.

Technical Details

In lib/adapters/fetch.js, getBodyLength() handles null bodies, Blob, spec-compliant FormData, ArrayBuffer values, URLSearchParams, and strings. It has no branch for ReadableStream, so resolveBodyLength(headers, data) returns undefined when no finite Content-Length header is present.

The maxBodyLength check only throws when the resolved outbound length is a finite number greater than the configured limit. For live streams, the check is skipped and the stream is passed to fetch().

When onUploadProgress is enabled, axios wraps the request body with trackStream(), but that wrapper only reports progress. It does not receive maxBodyLength and does not abort once loaded bytes exceed the cap.

The expected behavior exists in the HTTP adapter: lib/adapters/http.js enforces maxBodyLength for streamed uploads by counting chunks and rejecting with ERR_BAD_REQUEST.

Proof of Concept of Attack

Run from the axios repo root on Node 18+ against an affected version:

import http from 'node:http';
import axios from './index.js';

const LIMIT = 1024;
const PAYLOAD_BYTES = 2 * 1024 * 1024;

const server = http.createServer((req, res) => {
  let received = 0;
  req.on('data', (chunk) => {
    received += chunk.length;
  });
  req.on('end', () => {
    res.writeHead(200, { 'content-type': 'application/json' });
    res.end(JSON.stringify({ received, limit: LIMIT }));
  });
});

await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
const { port } = server.address();

function makeReadableStream(totalBytes) {
  const chunk = new Uint8Array(64 * 1024).fill(0x42);
  let remaining = totalBytes;

  return new ReadableStream({
    pull(controller) {
      if (remaining <= 0) {
        controller.close();
        return;
      }

      const next = remaining >= chunk.length ? chunk : chunk.subarray(0, remaining);
      remaining -= next.length;
      controller.enqueue(next);
    },
  });
}

try {
  const response = await axios.post(
    `http://127.0.0.1:${port}/upload`,
    makeReadableStream(PAYLOAD_BYTES),
    {
      adapter: 'fetch',
      maxBodyLength: LIMIT,
      headers: { 'content-type': 'application/octet-stream' },
    }
  );

  console.log(response.data);
} finally {
 …

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.3.

TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.4.

TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.0-tuxcare.1.

TuxCare rebuilt axios to address 9 CVEs. Fixed in 1.17.0-tuxcare.2.

TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.1-tuxcare.2.

TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.

TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.

TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.

These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-67317 in the axios package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-39j5-w47m-2gmv in the axios package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-jqh4-m9w3-8hp9 in the axios package for Root:npm. Multiple fixed versions available.