CVE-2026-67317

Axios versions 1.7.0 up to (but excluding) 1.18.0 fail to enforce the configured maxBodyLength limit when a request is sent through the fetch adapter with a WHATWG ReadableStream body whose Content-Length cannot be determined. An attacker or a misbehaving data source can supply unbounded, unknown-length stream data, causing the client to transmit far more data than the application's intended upload limit allows. The result is bypassed upload size limits, uncontrolled network egress, and possible local resource exhaustion on the sending host (CWE-770), with no direct loss of confidentiality or integrity. Any Node.js or bundled JavaScript application using an affected axios version with the fetch adapter and stream-based request bodies is exposed, though this usage pattern is a subset of axios's very large install base. There are no confirmed in-the-wild exploitation reports; EPSS is 0.5%, the issue is not in CISA KEV, and one public reference (GitHub advisory GHSA-jqh4-m9w3-8hp9) documents the flaw.

What to do: Upgrade to axios 1.18.0 or later, which restores maxBodyLength enforcement for unknown-length ReadableStream bodies in the fetch adapter. Until upgraded, audit whether your application sends WHATWG ReadableStream bodies through the axios fetch adapter where upload limits matter, and mitigate by buffering the body, setting an explicit Content-Length, or using a transport that honors maxBodyLength. Track the upstream advisory (GHSA-jqh4-m9w3-8hp9) for fix details and updates.