CVE-2026-67318

axios versions 1.13.0 and later, when using its Node.js HTTP adapter to send requests with httpVersion: 2, fail to enforce the configured maxBodyLength limit on streamed request bodies, because Node's HTTP/2 request API ignores the maxBodyLength option and axios's byte-counting stream wrapper only runs when maxRedirects is set to 0. The condition is triggered when an attacker controls the stream passed to axios in such an HTTP/2 request, causing the application to transmit outbound data exceeding its configured finite limit. The impact is uncontrolled resource consumption and policy bypass (excess egress bandwidth, upstream quota consumption, limited availability) rather than code execution, credential disclosure, or control of the request destination. Only Node.js applications running axios >= 1.13.0 with the HTTP/2 adapter, a finite maxBodyLength, and streamed bodies are affected; calls using the default maxBodyLength: -1 and the browser adapter are unaffected. No in-the-wild exploitation is known: EPSS is low (0.4%, 36th percentile), the issue is not in CISA KEV, and the flaw is documented in a public GitHub advisory with one referenced PoC.

What to do: Upgrade axios to the patched release once available and follow the mitigation details in the GitHub advisory GHSA-mwf2-3pr3-8698. As interim mitigations, avoid using httpVersion: 2 with streamed request bodies, keep the default maxBodyLength: -1, or set maxRedirects: 0 (which re-enables axios's byte-counting wrapper) when a finite limit must be enforced. Audit Node.js code paths that pass attacker-controlled streams to axios over HTTP/2 with a finite maxBodyLength configured.