HTTP Client Oversized Stream Handling Vulnerability in Axios
CVE-2026-42034

5.3MEDIUM

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
24 April 2026

What is CVE-2026-42034?

Axios, a popular JavaScript HTTP client, has a vulnerability that impacts stream request bodies. When maxRedirects is configured to 0, it allows for the maxBodyLength setting to be bypassed, resulting in oversized streamed uploads being sent in full, irrespective of the caller's body limit settings. This flaw is addressed in versions 1.15.1 and 0.31.1, reinforcing the importance of keeping libraries updated to mitigate such risks.

Affected Version(s)

axios >= 1.0.0, < 1.15.1 < 1.0.0, 1.15.1

axios < 0.31.1 < 0.31.1

References

https://github.com/axios/axios/security/advisories/GHSA-5...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.