Axios versions >=1.7.0 and <1.18.0 fail to enforce the maxBodyLength configuration limit for request bodies provided as WHATWG ReadableStreams in the fetch adapter when the Content-Length header cannot be determined. This flaw enables attackers to supply stream data of unknown length, bypassing upload size limits and potentially leading to resource exhaustion or excessive network usage. The vulnerability is tracked as CVE-2026-67317 and is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). No known exploits in the wild have been reported. No patch links are provided in the data, so patch status is not confirmed.

Attackers can bypass upload size restrictions by sending request bodies of unknown length, which may cause uncontrolled network egress or resource exhaustion on the affected system. This could degrade service availability or lead to denial-of-service conditions due to excessive resource consumption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of vulnerable Axios versions or implementing external controls to restrict request body sizes when using the fetch adapter with stream bodies.