MaxBodyLength Bypass in Axios HTTP Adapter for Node.js

CVE-2026-67318

What is CVE-2026-67318?

The axios library, specifically in versions from 1.13.0 to before 1.18.0, has a vulnerability in its Node.js HTTP adapter that fails to uphold the configured maxBodyLength limit for streamed request bodies sent over HTTP/2. This flaw arises from the Node.js request API not adhering to the maxBodyLength setting, combined with axios's stream handling logic. An attacker controlling a stream can exploit this behavior, leading to excessive data transmission that surpasses the intended maxBodyLength limit. While this issue primarily results in resource constraints and potential policy violations, it does not facilitate code execution, credential theft, or manipulation of request destinations. Requests utilizing default settings or browser adapters remain unaffected.

References