CVE-2026-67317: axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.18.0 - Configuration
Upgrade axios to 1.18.0 or later; versions 1.7.0 (before 1.18.0) can bypass maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length is not known.
axios (fetch adapter) maxBodyLength = enforced for WHATWG ReadableStream bodies when Content-Length cannot be determined
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67317?
The severity of CVE-2026-67317 is rated as medium with a CVSS score of 6.3.
How do I fix CVE-2026-67317?
To fix CVE-2026-67317, you should upgrade axios to version 1.18.0 or later.
What vulnerability does CVE-2026-67317 address?
CVE-2026-67317 addresses a maxBodyLength bypass in axios versions 1.7.0 to 1.18.0 allowing attackers to circumvent upload size limits.
What can an attacker do with CVE-2026-67317?
An attacker can exploit CVE-2026-67317 to supply unknown-length stream data, resulting in uncontrolled network egress or resource exhaustion.
Which software is affected by CVE-2026-67317?
CVE-2026-67317 affects the npm package axios versions prior to 1.18.0.