CVE-2026-67318

Name of the Vulnerable Software and Affected Versions axios versions 1.13.0 and later

Description When using the Node.js HTTP adapter, the software fails to enforce the maxBodyLength limit on streamed request bodies if the requests are sent with httpVersion: 2. This occurs because the Node.js HTTP/2 request API does not honor the maxBodyLength option, and the internal byte-counting stream wrapper is only activated when maxRedirects is set to 0.

An attacker who controls a stream passed to the software can cause the application to transmit outbound data that exceeds the configured finite maxBodyLength. This can lead to resource consumption and policy bypass, such as excess outbound bandwidth, increased egress costs, upstream quota consumption, and limited availability of the application or upstream peer. This issue does not allow for code execution, credential disclosure, or request-destination control.

Recommendations For versions 1.15.1 and later, set maxRedirects: 0 on affected HTTP/2 streamed upload calls to activate the stream wrapper and reject oversized streams. For versions prior to 1.15.1, pre-limit the stream with a byte-counting transform before passing it to the software, reject oversized uploads before forwarding them, or avoid using httpVersion: 2 for untrusted streamed uploads.