axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent… (CVE-2026-67318)
Axios versions 1.13.0 and later using the Node.js HTTP adapter do not enforce the configured maxBodyLength limit on streamed request bodies when HTTP/2 is used. This occurs because Node's HTTP/2 request API ignores the maxBodyLength option, and axios's internal byte-counting stream wrapper is only active when maxRedirects is zero. An attacker controlling the stream can cause the application to send more data than intended, potentially leading to resource exhaustion and bypass of data egress policies. This vulnerability does not allow code execution, credential leakage, or control over request destinations. Calls with the default maxBodyLength (-1) and browser adapters are not affected.
AI Analysis
Technical Summary
Axios versions >=1.13.0 using the Node.js HTTP adapter fail to enforce the maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. The root cause is that Node's HTTP/2 request API does not honor the maxBodyLength option, and axios's byte-counting stream wrapper is only enabled when maxRedirects is set to 0. This allows an attacker who controls the stream passed to axios to cause outbound data transmission exceeding the configured maxBodyLength. The impact is limited to resource consumption and policy bypass related to excess data egress and upstream quota consumption. There is no impact on code execution, credential disclosure, or request destination control. Browser adapters and calls using the default maxBodyLength (-1) are not affected.
Potential Impact
The vulnerability allows an attacker controlling the streamed request body to bypass the maxBodyLength limit, causing the application to send more data than configured. This can lead to resource exhaustion, excess outbound data consumption, and potential upstream quota depletion. However, it does not enable execution of arbitrary code, disclosure of credentials, or manipulation of request destinations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when using axios with Node.js HTTP adapter over HTTP/2 and consider limiting exposure to untrusted streams. Calls using the default maxBodyLength (-1) and browser adapters are not affected.
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent… (CVE-2026-67318)
Description
Axios versions 1.13.0 and later using the Node.js HTTP adapter do not enforce the configured maxBodyLength limit on streamed request bodies when HTTP/2 is used. This occurs because Node's HTTP/2 request API ignores the maxBodyLength option, and axios's internal byte-counting stream wrapper is only active when maxRedirects is zero. An attacker controlling the stream can cause the application to send more data than intended, potentially leading to resource exhaustion and bypass of data egress policies. This vulnerability does not allow code execution, credential leakage, or control over request destinations. Calls with the default maxBodyLength (-1) and browser adapters are not affected.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Axios versions >=1.13.0 using the Node.js HTTP adapter fail to enforce the maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. The root cause is that Node's HTTP/2 request API does not honor the maxBodyLength option, and axios's byte-counting stream wrapper is only enabled when maxRedirects is set to 0. This allows an attacker who controls the stream passed to axios to cause outbound data transmission exceeding the configured maxBodyLength. The impact is limited to resource consumption and policy bypass related to excess data egress and upstream quota consumption. There is no impact on code execution, credential disclosure, or request destination control. Browser adapters and calls using the default maxBodyLength (-1) are not affected.
Potential Impact
The vulnerability allows an attacker controlling the streamed request body to bypass the maxBodyLength limit, causing the application to send more data than configured. This can lead to resource exhaustion, excess outbound data consumption, and potential upstream quota depletion. However, it does not enable execution of arbitrary code, disclosure of credentials, or manipulation of request destinations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when using axios with Node.js HTTP adapter over HTTP/2 and consider limiting exposure to untrusted streams. Calls using the default maxBodyLength (-1) and browser adapters are not affected.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fqj3-h9pc-443h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67318"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6e6294bf32cb7a344f6932
Added to database: 08/01/2026, 21:18:12 UTC
Last enriched: 08/01/2026, 21:21:34 UTC
Last updated: 08/01/2026, 22:17:57 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.