CVE-2026-67317 Details
Description
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
A vulnerability exists in Axios versions 1.7.0 prior to 1.18.0, where the fetch adapter fails to properly enforce the maxBodyLength setting for WHATWG ReadableStream request bodies when the Content-Length cannot be determined. This allows attackers to send unknown-length stream data that bypasses upload size limits, potentially leading to uncontrolled network egress or resource exhaustion. The issue arises in environments that use the fetch adapter, such as certain edge runtimes, as well as in Node.js or browser environments where the fetch adapter is explicitly selected.
Users can update Axios to version 1.18.0 or later, or use the HTTP adapter for untrusted stream uploads in Node.js environments.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9 | [email protected] | ExploitMitigationVendor Advisory |
| https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | >= 1.7.0, < 1.18.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |